IIS Lockdown and URLScan on E2K (Full Version)

All Forums >> [Microsoft Exchange 2000] >> Server Security


JWeaver -> IIS Lockdown and URLScan on E2K (16.Jan.2004 9:46:00 PM)

I am seeking any guidance on running IIS Lockdown and/or URLScan on my backend mailbox servers.

More specifically, any reason to do it and any issues that have been encountered by doing either of them.

Thanks in advance.

koggen -> RE: IIS Lockdown and URLScan on E2K (17.Jan.2004 12:55:00 AM)

I can't give you any deeper insight on reasons for configuring URLScan specifically for FE/BE solutions, but I can give you some details on general potential issues. URLScan has been known to cause problems in certain cases, recently a user posted about authentication problems in OWA for users with IE but not for users with Netscape. After much investigation it turned out that URLScan was the cause. Also, since my native language has several special characters I've hade frequent problems (especially when e.g. english users reply to messages containing special characters in the message subject), despite several improvements to the latest version of URLScan.

So, the known problems that can occur are authentication problems and problems displaying whole or part of OWA. I still use URLScan on our servers, but I have had to disable several options to make things work.

// Johan

Page: [1]