Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given a server's only role is to be a webserver, and the server is only for hosting dedicated applications there is no kind of collocation / user manageable websites.

Is there really any purpose to applicationHost.config settings of overrideModeDefault="Deny"?

Would there be any reasons that replacing all Deny with Allow would be a bad idea?

share|improve this question
An example of a setting that you'd want to override would be useful. – Kev Jun 15 '12 at 23:17

To quote the docs, the overrideModeDefault="Deny" attribute is generally used to deny changes to configuration settings that:

are related to any performance, security or critical aspect of the server ... [snipped] ... If the overrideModeDefault attribute is set to "Deny", then any configuration files at a lower level (i.e. web.config files) [my emphasis]

Even in an environment where your server (public facing) is dedicated to running your own applications, it's generally good practice to not allow changes these settings. The reason being that if your site is hijacked it can't be further subverted by allowing attackers to add their own ISAPI filters or tinker with other critical settings in a site's web.config file.

Another reason being is where you have developers (who are not server admins) who may not understand the implications of casually overriding a setting to get something to work in a site's web.config which may affect the overall performance and security of the server.

If you have full control over the server then it's still better to keep these changes restricted to applicationHost.config rather than allow them to be set willy nilly in site web.config files. The server admin team then become the gatekeepers of any changes that might need to be applied for a particular site.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.