I think it is interesting that MS is trying this type of tool and that it
seems everyone is disappointed with the tool. What did you expect ?

I think this shows the value of Tools like Harris Stat, and especially HP
WebEnforcer - WebEnforcer hardens the settings that the MS tool does and
also allows you to reverse the settings (all but a couple) which allows you
to tweak to your needs. It also auto repairs and sends alerts when
something changes. And.. it shows you what patches you are missing and
assists in installing them. Now of course HP wants you to buy one for every
server, but you can use it just as a harden and patch tool, uninstalling it
when you complete the patching and hardening. Don't get me wrong it does
not harden all the things we would like, but on the servers I installed it
on - it avoided Code Red without the patch !!! the proper approach to
avoiding unknown vulnerabilities.

It is worth taking a look at - save yourself the headache of the MS tool.
Stat has some similar features, but I prefer HP WebEnforcer. Don't trust
MS when a vendor like HP who has created a tool, I am sure to fix their own
ill's, does what this thread is discussing and well.

Not that I am biased, but it is a good tool that solves the lack of MS focus
on Security and helps when you need more time to patch the servers.

RUSecure ?

MG

-----Original Message-----
From: Marc Fossi [mailto:mfossisecurityfocus.com]
Sent: Thursday, August 23, 2001 2:59 PM
To: Focus-MS
Subject: MS IIS Lockdown tool

Has anyone else seen or used this yet? I'm sure this list would be
interested in any feedback/comments about it.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutio
ns/security/tools/locktool.asp

I find it quite interesting that MS has been releasing so many security
tools lately...

Marc Fossi, MCSE
SecurityFocus
www.securityfocus.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]