Changes to urlscan.ini file

[adam97]

The server group in my company is trying to get the web servers locked down.
They've been changing the RemoveServerHeader variable in
WINNT\system32\inetsrv\urlscan\urlscan.ini from 0 to 1. There have been no
problems with this whatsoever except on the CF servers which starts displaying
http header info at the top of the pages. There is a TechNote
[url]http://www.macromedia.com/cfusion/knowledgebase/index.cfm?id=tn_18168[/url], which
does absolutely nothing. Anybody else run accross this?



[options]
UseAllowVerbs=1 ; if 1, use [AllowVerbs] section, else use
[DenyVerbs] section
UseAllowExtensions=0 ; if 1, use [AllowExtensions] section, else use
[DenyExtensions] section
NormalizeUrlBeforeScan=1 ; if 1, canonicalize URL before processing
VerifyNormalization=1 ; if 1, canonicalize URL twice and reject
request if a change occurs
AllowHighBitCharacters=0 ; if 1, allow high bit (ie. UTF8 or MBCS)
characters in URL
AllowDotInPath=0 ; if 1, allow dots that are not file extensions
RemoveServerHeader=0 ; if 1, remove "Server" header from response
EnableLogging=1 ; if 1, log UrlScan activity
PerProcessLogging=0 ; if 1, the UrlScan.log filename will contain a
PID (ie. UrlScan.123.log)
AllowLateScanning=0 ; if 1, then UrlScan will load as a low
priority filter.
PerDayLogging=1 ; if 1, UrlScan will produce a new log each day
with activity in the form UrlScan.010101.log
RejectResponseUrl= ; UrlScan will send rejected requests to the
URL specified here. Default is /<Rejected-by-UrlScan>
UseFastPathReject=0 ; If 1, then UrlScan will not use the
RejectResponseUrl or allow IIS to log the request

; If RemoveServerHeader is 0, then AlternateServerName can be
; used to specify a replacement for IIS's built in 'Server' header
;AlternateServerName=

[adam97]

Anyone...anyone?