I have iisstart.htm,error404.htm(custom error page) pages in my web
application for . When a user reuests page and resource is not found on web
server then the web server executes iisstart.htm and not the error404.htm,
bacause of which the status code logged in IIS log file ...

I received an inquiry by our security team today saying that a standard scan
of our servers reported that one of our IIS servers (that is running IIS 6)
triggered a warning of a potential vunerability: CVE-2007-2897.
The text we were given for the vunerability was:

I am using IIS 6 trying to prevent a user group from being able to access the
virtual directories.  I have prevented the group from accessing files on the
IIS server by turning off anonymous authentication.  however if the users in
the restricted group know the virtual directory ...

we need a "Single Sign On" Intranet Windows Username Authentication,
(or ActiveDirectory) for our ASP.NET website, where no Dialog box is
popping up!
If not possible, a single first Logon would be ok. Something like:

I want to be able to backup my entire server and server configuration so in
case something crashes all I will need to do is restore the backup. How is
this done?
James

I am looking for some guidance on securing an OWA server.  
Initially, I was under the impression that we needed to purchase an SSL cert
from a vendor to secure the server.  However, in searching the Internet, it
appears (if I understood it correctly) there is another option where ...

I need advice on proper placement of my webserver. Our webserver is
multihomed. One interface has out public IP bound and the other one has an
assigned IP on our internal network. Not sure why it was setup this way. the
internal NIC has no gateway.... this makes administring this ...

I get the following error when I hit the Browse menu item of Default.aspx of
a IIS 5.1 Virtual Directory.   If the File Security of the Default.aspx or
the Directory Security of the Virtual Directory is changed to Integrated
Windows Authentication from Anonymous Access, I won't ...

Geeeesh ... my server, running MS IIS, just got DDOS attacked and
died. Dunno who launch it yet.
And trying to fix the mess, and in the meantime, these are the stuffs
I found online --

please where i can find the registry ket thet will manage the extende logging
optoin in IIS 6 ?

IIS Server behind a router is being hit internal machines which are alse
behind a router.
the hit/request is "E", "C" as the csUriStem in the IIS Logs.... looks like
going after the drive/share name on the web server.