How to configure URLScan 2.5 to allow .stm files?

Archived from groups: microsoft.public.win2000.security (More info?)

We have a W2K Server SP4 running IIS 5.0. IIS Lockdown 2.1 and
URLScan 2.5 were run on the box.

We need to allow .stm files to run. When I remove URLScan from the
server the .stm files will run. However, I want all the other
functions of URLScan, so I want to configure URLScan to allow .stm
files.

I've made the following changes to the urlscan.ini file, but .stm
files are still being blocked by URLScan.

Changes to urlscan.ini:

I left the default UseAllowExtensions=0 and I commented out first and
then removed .stm ; Maps to ssinc.dll, for Server Side Includes,
from [Deny Extensions].

I then tried setting UseAllowExtensions=1 and added .stm to
[AllowExtensions], but I still receive the following message in the
urlscan log:

URL contains extension '.stm', which is disallowed. Request will be
rejected. Site Instance='4', Raw URL=''

I stopped/started the web site for each of the above changes.


Any help would be appreciated.

Thanks,

Dave

*If responding by e-mail please remove the "NOSPAM".
1 answer Last reply
More about configure urlscan files
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    Please disregard URLScan is now working properly.

    On Sat, 21 Aug 2004 19:27:42 GMT, DJO <djo.oconnor@NOSPAMverizon.net>
    wrote:

    >
    >
    >We have a W2K Server SP4 running IIS 5.0. IIS Lockdown 2.1 and
    >URLScan 2.5 were run on the box.
    >
    >We need to allow .stm files to run. When I remove URLScan from the
    >server the .stm files will run. However, I want all the other
    >functions of URLScan, so I want to configure URLScan to allow .stm
    >files.
    >
    >I've made the following changes to the urlscan.ini file, but .stm
    >files are still being blocked by URLScan.
    >
    >Changes to urlscan.ini:
    >
    >I left the default UseAllowExtensions=0 and I commented out first and
    >then removed .stm ; Maps to ssinc.dll, for Server Side Includes,
    >from [Deny Extensions].
    >
    >I then tried setting UseAllowExtensions=1 and added .stm to
    >[AllowExtensions], but I still receive the following message in the
    >urlscan log:
    >
    >URL contains extension '.stm', which is disallowed. Request will be
    >rejected. Site Instance='4', Raw URL=''
    >
    >I stopped/started the web site for each of the above changes.
    >
    >
    >Any help would be appreciated.
    >
    >Thanks,
    >
    >Dave
    >
    >*If responding by e-mail please remove the "NOSPAM".
Ask a new question

Read More

Configuration Servers Windows