Introduction

Microsoft s Internet Information Services (IIS) is one of the most popular Web servers used on the Internet and in Intranets throughout the world. Windows Server 2003 includes the latest version, IIS 6.0. There have been changes, additions, and improvements to the software in the areas of core functionality and services, administration, security, and performance. IIS 6.0 has been redesigned to provide better reliability and more flexibility in configuring application environments.

In the past, Web servers have been a common vulnerability for hackers. It has been common for servers to be running rogue Web services without the knowledge of administrators. Thus, for security reasons, IIS 6.0 is not installed by default on Windows Server 2003 servers, with the exception of the Web Server Edition. When it is installed, it is initially configured in a high security mode.

Web servers are common targets due to their exposure to those outside the local network; therefore security is a priority in IIS 6.0. Consequently, a number of important Web services features which worked automatically in previous versions now need

to be explicitly enabled before they will work. This new focus on security means network administrators need to familiarize themselves with these changes in order to provide the Web server services needed on their networks.

This chapter examines the installation and configuration process for IIS 6.0 and introduces new security features, reliability features, and other new features. This chapter also shows how to use the Web Server Security Lockdown Wizard and how to manage security...