A vulnerability scan of our network has turned up this response:
"On this site, there is a problem with IIS. The SMB service has insecure permissions for Everyone: IIS Admin Service (IISADMIN) : DC, WD, WO http://oursite.com"
I've been looking at the services, and reading up on Windows SMB (Server Message Block) but still am not able to really detect what the problem is here. Does anybody have more understanding of SMB service or windows permissions, and can turn me in the right direction?
I've looked at the services, there is an "IIS Admin" service and I've checked the permissions on the executable (C:\windows\system32\inetsrv\inetinfo.exe) but it doesn't list anything abnormal:
C:\Inetpub\wwwroot\FM>cacls C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe BUILTIN\Users:R BUILTIN\Administrators:F NT AUTHORITY\SYSTEM:F
I've also checked the Local Security Settings:
Microsoft network client: Digitally sign communications (always) Disabled Microsoft network client: Digitally sign communications (if server agrees) Enabled Microsoft network server: Digitally sign communications (always) Disabled Microsoft network server: Digitally sign communications (if server agrees) Disabled
Any help or direction is much appreciated!