|
Home > Archive > IIS Server Security > December 2007 > IISHelp
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
|
|
| BigSam 2007-12-22, 1:29 pm |
| A few months ago I removed the Virtual Directory IISHelp from the Default web
site on my IIS servers, as a recommendation in the Microsoft Baseline
Security Analyzer. All of this was part of the configuration of new W2k3
servers that we were migrating to.
Now one of our develoipers is having a hissy fit, saying he needs IISHelp
restored because 'There is code in the 500-100.asp that performs valuable
functions for our application like doing a database rollback when an error is
encountered.'
Orginally he said 'The 500-100.asp logs all errors encountered on our web
site. This is the only way we know that our customer's are experiencing
problems. Furthermore, since I modified this page to no return any pertinent
information to the customer, I have no way of knowing how to debug a web page
with errors.'
I think he's blowing smoke on the database rollback, but don't know for
sure. Our web pages are a combination of classic ASP & ASP.Net.
Is it possible to use IISHelp for a database rollback?
If there is, is it a good policy?
Are the other or better methods to accomplish both of his goals?
| |
| Roger Abell [MVP] 2007-12-23, 1:36 am |
| Take a look for yourself BigSam, as the file is still at
C:\WINDOWS\Help\iisHelp\common or similar in
your install if you only removed IIShelp vdir. You
will see that the dev is blowing smoke, unless there
had been a modified file. If it was a modified file,
then just install it as the page for handling those errs.
Your comment that the dev said they had modified it
so that it does not reveal info, etc. and that it is needed
for the debugging info it logs makes it sound pretty much
no longer the MS shipped file.
Roger
"BigSam" <BigSam@discussions.microsoft.com> wrote in message
news:DD0FB7C0-DDCD-43E9-91B8-9181E0820697@microsoft.com...
>A few months ago I removed the Virtual Directory IISHelp from the Default
>web
> site on my IIS servers, as a recommendation in the Microsoft Baseline
> Security Analyzer. All of this was part of the configuration of new W2k3
> servers that we were migrating to.
> Now one of our develoipers is having a hissy fit, saying he needs IISHelp
> restored because 'There is code in the 500-100.asp that performs valuable
> functions for our application like doing a database rollback when an error
> is
> encountered.'
> Orginally he said 'The 500-100.asp logs all errors encountered on our web
> site. This is the only way we know that our customer's are experiencing
> problems. Furthermore, since I modified this page to no return any
> pertinent
> information to the customer, I have no way of knowing how to debug a web
> page
> with errors.'
>
> I think he's blowing smoke on the database rollback, but don't know for
> sure. Our web pages are a combination of classic ASP & ASP.Net.
> Is it possible to use IISHelp for a database rollback?
> If there is, is it a good policy?
> Are the other or better methods to accomplish both of his goals?
|
|
|
|
|