You should allow the get command for .exe extensions in the .ini file located at C:\WINNT\system32\inetsrv\urlscan. The only thing you must do is to erase the line in [DenyExtensions] which references to execute .exe files on the server, but be careful because this is a security hole, because many exploits use the cmd.exe tool that is located in the winnt\system32 dir.... I recommend you that you change the path of cmd.exe, and place it in a directory with ONLY administrative rights. Regards.
Mauri -----Mensaje original----- De: CHM Security [mailto:[EMAIL PROTECTED]] Enviado el: sábado, 09 de marzo de 2002 0:56 Para: [EMAIL PROTECTED] Asunto: URLScan I am running Citrix nfuse on a IIS 5 server and attempted to install the urlscan.exe from M$. I have very limited knowledge on web servers and everytime I install the urlscan it kills the ability of clients to download the citrix web client (ica32t.exe) file. Like I said I have very limited knowledge of web servers and I'm not sure how I can edit the urlscan ruleset to allow this to happen. I would really like to run the urlscan tool to receive all of the benefits it provides, but as of right now I can't because it kills necessary functionality. Any help would be greatly appreciated! _________________________________________________________________ Join the world’s largest e-mail service with MSN Hotmail. http://www.hotmail.com
