Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry AtHoc
  3. 7.19
  4. Install and Configure BlackBerry AtHoc
  5. IIS 10.0 Security Technology Implementation Guide
  6. Application STIG
  7. IIST-SI-000221: Restrict anonymous access accounts

IIST-SI-000221: Restrict anonymous access accounts

Anonymous IIS 10.0 website access accounts must be restricted.
To check compliance with IIST-SI-000221, complete the following steps for each site hosted on the IIS 10.0 web server:
  1. Open the IIS 10.0 Manager.
  2. Click the website name.
  3. Under
    IIS
    , double-click
    Authentication
    .
  4. If Anonymous Access is disabled, this is not applicable. If Anonymous Access is enabled, click
    Anonymous Authentication
    .
  5. In the
    Actions
     pane, click
    Edit
    .
  6. If the
    Specific user
     option is selected and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Take note of the account name.
  7. Check privileged groups that may allow the anonymous account inappropriate membership:
    1. On the computer, open
      Server Manager
      .
    2. Expand
      Configuration
      .
    3. Expand
      Local Users and Groups
      .
    4. Click
      Groups
      .
    5. Review members of the following privileged groups:
      • Administrators
      • Backup Operators
      • Certificate Services (of any designation)
      • Distributed COM Users
      • Event Log Readers
      • Network Configuration Operators
      • Performance Log Users
      • Performance Monitor Users
      • Power Users
      • Print Operators
      • Remote Desktop Users
      • Replicator
    6. Double-click each group and review its members.
If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, your application is not compliant.
If your application is not compliant, remove the Anonymous Access account from all privileged accounts and all privileged groups.