The IIS server rejects access to the computer through the network.

We have learned a lot about IIS servers. The security templates do not contain Anonymous logon, built-in Administrator Accounts, Support_388945a0, Guest, and all non-operating system service accounts. For each domain in an organization, these accounts and groups have a unique security identifier (SID ). Therefore, you must manually add them. Let's look at the table below.

IIS server settings

 
 

  
  
The default value of the member server is the high security of the old client enterprise client.
  
  
SUPPORT_388945a0
  
  
Anonymous Logon; Built-in Administrator account; Support_388945a0; Guest; all non-operating system service accounts
  
  
Anonymous Logon; Built-in Administrator account; Support_388945a0; Guest; all non-operating system service accounts
  
  
Anonymous Logon; Built-in Administrator account; Support_388945a0; Guest; all non-operating system service accounts
 
 

The "deny access to the computer through the network" setting determines which users cannot access the computer through the network.

These settings reject a large number of network protocols, including the Server Message Block (SMB) protocol, the Network Basic Input/Output System (NetBIOS), and the general Internet File System (CIFS) hypertext Transfer Protocol (HTTP) and Component Object Model (COM + ).

When both policies are applied to the user account, this setting overwrites the "allow access to the computer through the network" setting. By configuring this user permission for other groups, you can restrict the ability of users to perform delegated management tasks in your environment.

In the Member Server benchmark for the module to create a Windows Server 2003 Server, this Guide recommends that you include the Guests group in the user and group list assigned this permission to provide maximum security.

However, the IUSR account used to access the IIS server anonymously is a member of the Guests group by default. In this guide, we recommend that you clear the Guests group from the incremental IIS Group Policy to ensure that you can configure anonymous access to the IIS server if necessary.

Therefore, in all three environments defined in this Guide, we configure "Deny access to this computer over the network" for IIS servers to include: anonymous logon, built-in Administrator, Support_388945a0, Guest, and all non-operating system service accounts.