IISADMPWD Directory

The STG CATI finding for the IISADMPWD directory can be resolved. You do not need to delete the directory.

Simply break inheritance of permissions, and ensure that only the administrators and system account/group have full rights to the folder.

Then, go into IIS and ensure that the IISADMOWD virtual directory does not exist in a sub folder of a website.

I've done this on the interim SharePoint server and everything works properly.

Below additional details / instructions:

Vulnerability Details

A IISADMPWD directory was found in the root:
C:\WINDOWS\system32\inetsrv\


Vulnerability Discussion:

The IISADMPWD directory is included by default with IIS. It allows users to reset Windows passwords. The use of use rid and passwords is a far less secure solution for controlling user access to web applications than a PKI solution with subscriber certificates. The capability to be able to change passwords externally gives potential intruders an easier mechanism to access the system in an effort to compromise use rids and passwords.

Manual Fix Procedures:

If possible, ensure the IISADMPWD directory has been removed from the web server.

NOTE 1:

There have been numerous reports of sites not being able to delete this directory without Windows File Protection automatically restoring it. The work around for this will be to ensure the virtual directory is removed from all web sites associated with the server and to restrict access for this directory and files to the system and administrators.

NOTE 2:

You may be able to delete the .dll in the IISADMOWD folder by going into safe mode and deleting it. This will not work for the folder.

If the IISADMPWD directory cannot be deleted set the permissions as
follows:

Administrators - Full Control
System - Full Control

Also, review all web sites associated with this server and ensure any virtual directories pointing to IISADMPWD are removed.

A virtual directory will be a child directory to a web site.

References and additional information:

WEB SERVER SECURITY TECHNICAL IMPLEMENTATION GUIDE - Section 2.1


IA Controls
ECSC-1 - Security Configuration Compliance