Securing an IIS 5.0 Web Server on Windows 2000 using Security Tools and Templates

This paper attempts to give an overview of the security guides, tools and templates available from Microsoft, and to describe the basic steps involved in applying the tools and templates. The commonalities and differences between the security templates available are highlighted, and how several of these tools and templates can be used together to benefit from the settings made by each one is described. As an example the securing of a standalone Windows 2000 Web Server is discussed, and an appropriate sequence of use (i.e. apply the baseline, IIS incremental and hisecweb templates then the IIS lockdown tool) for the tools and templates for IIS 5.0 web servers is suggested.