Users can browse the contents of the “res” and “netpub” virtual directories on Windows-based NetPublish servers

Description

The default settings on the IIS virtual directories that NetPublish creates allow users to browse the contents of those directories; this allows access to files that may contain sensitive information.

Solution

Turn off directory browsing on the NetPublish virtul directories; this does not affect NetPublish functionality.

NOTE: These instructions assume that the NetPublish virtual directories are set up on the default web site.

For IIS 6

1. Launch Internet Information Services Manager
2. Go to Web Sites > Default Web Site > “netpub”
3. Right click on “netpub” and select ‘Properties’
4. Under ‘Local Path’, uncheck the “Directory browsing” checkbox; click ‘Apply’, then ‘OK’. The change takes effect immediately.
5. Repeat steps 2-4 for the “res” virtual directory listed underneath “netpub”.

For IIS 7

1. Launch Internet Information Services Manager
2. Go to Sites > Default Web Site > “netpub”
3. In the Features View, double-click on ‘Directory Browsing’
4. Under ‘Actions’ in the rightmost column, click “Disable”. The change takes effect immediately.
5. Repeat steps 2-4 for the “res” virtual directory listed underneath “netpub”..