| Microsoft IIS Lockdown Tool is a wizard driven utility that works by turning off unnecessary features within IIS. For more information, please visit: http://download.microsoft.com/download/iis50/Utility/2.1/NT45XP/EN-US/iislockd.exe IIS Lockdown Tool requires Windows NT 4.0 running IIS 4.0 or Windows 2000 running IIS 5.0. Note: The following procedures do NOT work on a web server running the Citrix Web Console. I have not been able to successfully lock down an IIS server running the CWC with the IIS Lockdown utility and still have it function. If you have any suggestions please email: dbrown@dabcc.com and I will add them to the next release of MIAB. The following details how to install and configure the IIS Lockdown utility to work with Web Interface 2.1. 1. Download the IIS Lockdown Utility from Microsofts web site 2. Start iislockd.exe and click Next 
3. Click the I agree radio button and click Next. 
4. Select Dynamic Web Server (ASP enabled) and check the View templates settings checkbox and click Next. 
5. Click Next. 
6. Click Next. 
7. Uncheck the Scripts checkup and click Next. 
8. Click Next. 
Note: If you will be using URLScan then you will need to be aware that the default URLScan configuration prevents any reference to .EXE and .DAT files on the IIS Web Server. What does this mean to a Web Interface 2.1 deployment? It means that if you accept to install URLScan you will prevent anyone from having the ability to download the web ICA32T.EXE file from the Web Interface 2.1 Application portal, it also stop the JAVA client from downloading the ICAPRINTERS.DAT file. 9. In order to workaround this issue you will need to comment out the .dat extension in the urlscan.ini file on the server and reset IIS. 
10. As for the ICA32t.EXE file you either have to rename it (maybe .zip or .ex_) and change the associated name for the file in the \Nfuse17\Include\Install.vbs file or change the download link to point to the Citrix web site for the ICA client download - this requires a bit of editing in the same Install.vbs file. 11. Click Next. 
12. Click Next. 
13. Click Finish 
Internet Information Server Wizard creates two new local groups. Web Anonymous Users Web Applications. The local IUSR_COMPUTERNAME account is now member of Web Anonymous Users group. The wizard sets permissions using these two groups. Web Interface requires that the IUSR_COMPUTERNAME account have at least modify rights to C:\Inetpub\wwwroot\NFuseIcons folder. If IUSR_COMPUTERNAME account does not have the right permission to the folder, then the user will not see the icon for the published application on the Web Interface page.
|