1.1 Ensure 'Web content' is on non-system partition

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Web resources published through IIS are mapped via Virtual Directories to physical locations on disk. It is recommended to map all Virtual Directories to a non-system disk volume.

Rationale:

Isolating web content from system files may reduce the probability of web sites/applications exhausting system disk space. It can also reduce the file IO vulnerability in the web site/application from affecting the confidentiality and/or integrity of system files.

Impact:

Once the configuration is changed all content from the root drive to the new drive including ACLs and empty directories will need to copied.

Solution

Browse to web content in C:\inetpub\wwwroot\

Copy or cut content onto a dedicated and restricted web folder on a non-system drive such as D:\webroot\

Change mappings for any applications or Virtual Directories to reflect the new location

To change the mapping for the application named app1 which resides under the Default Web Site, open IIS Manager:

Expand the server node

Expand Sites

Expand Default Web Site

Click on app1

In the Actions pane, select Basic Settings

In the Physical path text box, put the new location of the application, D:\wwwroot\app1 in the example above

Default Value:

The default location for web content is: %systemdrive%\inetpub\wwwroot.

See Also

https://workbench.cisecurity.org/files/4131