Question : How do I configure the built-in URLscan to IIS 6?

Hello All,

There's all this talk about IIS 6 being more secure, and having many of the URLscan functionality built-in. A good thing. BUT, I've noticed I can't download *.log even though they have permission to download. How can I configure what can and cannot be changed? This server does not have IIS Lockdown 2.5 or a directory for URLscan under  C:\WINDOWS\system32\inetsrv . The directory and files have the IUSR account with read permissions.

The general error received:
HTTP Error 404 - File or directory not found.
Internet Information Services (IIS)

Thanks,
-Ben

Answer : How do I configure the built-in URLscan to IIS 6?

There really isn't a 'version' of URLScan built into IIS 6.0 - it simply incorporates a number of the features that URLScan provides for IIS 5.

You can install URLScan 2.5 on IIS 6.0 for a couple added features such as URL Sequence blocking and Server Banner suppression.

In any case, there is no way to disable MIME type blocking in IIS 6.0, but you can bypass it by adding a MIME type of * with a type of application/octet-stream.  This will provide a default MIME type for all files that don't have one.

Dave Dietz