Securing Internet Information Server (IIS) 6 for DMZ Placement

The default web site is well known and could have some inherent vulnerabilities; it is best to ensure that this web site is deleted and create a new one for your purposes.

From the master properties for the web server, remove all unnecessary mime types by deleting any type of file extension that will not be served by this web server. These mime types can be added later if necessary.

Set the IIS logging parameters at the "Web Sites" level so that all new sites will inherit these settings.

Set the logging location to the secure location or the drive allocated for these logs (F:\securelogs). Set the NTFS permissions on this folder to System and Administrators to ‘Full Control’ on this partition and remove the ‘Everyone’ group from this folder.