Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IIS6 had some tools for hardening, against attacks and holes.

Does IIS7 have the same?

If not, are there some standard thingst that should be done to protect it?

share|improve this question
up vote 3 down vote accepted

IIS 7 is much more secure out of the box, operating off of an "opt-in" model for features rather than opt-out as with previous versions. In order to read up on hardening IIS 7 however, you will want to download the Windows Server 2008 Security Guide (the actual file you want is Security Compliance Management Toolkit _ Windows Server Chapter 6 covers Hardening Web Services (aka IIS 7).

share|improve this answer

You can also look at the Security Configuration Wizard found under the administrative tools within Windows Server 2008, although much of it won't do you a lot of good without a greater understanding of the potential holes, the wizard will still walk you through closing down certain ports and shutting down miscellaneous running services.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.