Configure Web Service Extensions (IIS 6.0)

In order to take a more proactive stance against malicious users and attackers, Internet Information Services (IIS) is not installed on members of the Microsoft® Windows® Server 2003 family by default. Furthermore, when you initially install IIS, it is installed in a highly secure mode. By default, IIS serves only static content — features such as ASP, ASP.NET, server-side includes, WebDAV publishing, and FrontPage 2002 Server Extensions from Microsoft do not work unless they are specifically enabled. You can configure these features, also called Web service extensions, through the Web Service Extensions node in IIS Manager.

Requirements

•	Credentials: Membership in the Administrators group on the local computer.
•	Tools: Iis.msc.

Top of page

Recommendation

As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use the Run as command to run IIS Manager as an administrator. At the command prompt, type: runas /user:administrative_accountname “mmc %systemroot%system32inetsrviis.msc”.

Top of page

Procedures

To enable and disable a Web service extension

1.	In IIS Manager, expand the local computer, and then click Web Service Extensions.
2.	In the details pane, click the Web service extension that you want to enable or disable.
3.	To enable a disabled Web service extension, click Allow.
4.	To disable an enabled Web service extension, click Prohibit. A message box with a list of applications that will be prevented from running on the IIS Web server displays.
5.	Click OK to disable the Web service extension.

To use, or to deny the use of, an HTTP request handler that is not in the list of Web service extensions, you must first register it by adding the HTTP request handler to the list of Web service extensions.

To add new Web service extensions

1.	In IIS Manager, expand the computer name, and then click Web Service Extensions.
2.	In the details pane, click Add a new Web service extension.
3.	In the Extension name text box, type the name of the new Web service extension, and then click Add.
4.	In the Path to file text box, type the path or click Browse to navigate to any files that the new Web service extension requires, and then click OK.
5.	Optionally, select the Set extension status to Allowed check box to automatically set the status of the new Web service extension to Allowed.
6.	Click OK to add the new Web service extension.

To delete Web service extensions

1.	In IIS Manager, expand the computer name, and then click Web Service Extensions.
2.	In the details pane, right click the Web Service Extension you want to delete, and then click Delete.
3.	Click Yes to confirm the deletion.

You can also use IIS Manager to specify the applications that are allowed to call Web service extensions.

To allow an application to call Web service extensions

1.	In IIS Manager, expand the local computer, and then click Web Service Extensions.
2.	In the details pane, click Allow all Web service extensions for a specific application.
3.	From the Application list box, click the name of the application. The Web service extension that the application is allowed to call appears in the Extensions to be allowed box.
4.	Click OK to allow the application to call Web service extensions.

You can disable all Web service extensions that are registered on the local computer with one setting in the Web Service Extension node of IIS Manager.

To disable all Web service extensions

1.	In IIS Manager, expand the local computer, and then click Web Service Extensions.
2.	Click Prohibit all Web service extensions. The following message appears: If you prohibit all extensions, all Web service extensions in the list will be prohibited. This may prevent applications from running on your IIS Web server. Do you want to prohibit all extensions?
3.	To disable all extensions, click Yes. To cancel the action, click No. For more information, click Help.
4.	If you click Yes, the status of each Web service extension is Prohibited.

<!– –>