Information
Provides Web connectivity and administration through the Internet Information Services Manager.
The recommended state for this setting is: Disabled or Not Installed
Note: This service is not installed by default. It is supplied with Windows, but is installed by enabling an optional Windows feature (
Internet Information Services - World Wide Web Services
).
Note #2: An organization may choose to selectively grant exceptions to web developers to allow IIS (or another web server) on their workstation, in order for them to locally test and develop web pages. However, the organization should track those machines and ensure the security controls and mitigations are kept up to date, to reduce risk of compromise.
Hosting a website from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased. If proper security mitigations are not followed, the chance of successful attack increases significantly.
Note: This security concern applies to
any
web server application installed on a workstation, not just IIS.
Solution
To establish the recommended configuration, run the following PowerShell command or ensure the service is not installed.
Set-Service -Name W3SVC -StartupType Disabled
Impact:
IIS Web Services will not function.