The IIS 10.0 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-218826 | IIST-SV-000200 | SV-218826r960735_rule | CCI-000054 | medium |
| Description | ||||
| Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive). | ||||
| STIG | Date | |||
| Microsoft IIS 10.0 Server Security Technical Implementation Guide | 2025-06-11 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
AC-10
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-000054
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-218826r960735_chk)
Access the IIS 10.0 IIS Manager.
Click the IIS 10.0 server.
Select "Configuration Editor" under the "Management" section.
From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
Expand "siteDefaults".
Expand "limits".
Review the results and verify the value is greater than zero for the "maxconnections" parameter.
If the maxconnections parameter is set to zero, this is a finding.
Fix Text (F-20296r310954_fix)
Access the IIS 10.0 IIS Manager.
Click the IIS 10.0 server.
Select "Configuration Editor" under the "Management" section.
From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites".
Expand "siteDefaults".
Expand "limits".
Set the "maxconnections" parameter to a value greater than zero.