OpenControls Logo

STIG Viewer

STIGViewer Support

The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-218752IIST-SI-000224SV-218752r1111807_ruleCCI-001084medium
Description
The content database is accessed by multiple anonymous users when the web server is in production. By locating the content database on the same partition as the web server system file, the risk for unauthorized access to these protected files is increased. Additionally, having the content database path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.
STIGDate
Microsoft IIS 10.0 Site Security Technical Implementation Guide2025-06-09

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

END-16Restrict Access To Security Functions
0.50
SEA-04.1Security Function Isolation
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (29) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-3Access Enforcement
1.00
AC-3(13)Attribute-based Access Control
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00

+19 more (top 10 by confidence shown)

CCI1 mapping
CCI-001084
1.00

Details

Check Text (C-218752r1111807_chk)

Note: If this server is hosting WSUS, this requirement is not applicable. Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is not applicable. Note: If this server is hosting the SharePoint Web Services site, this requirement is not applicable. Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Click the site name under review. Click the "Advanced Settings" from the "Actions" pane. Review the Physical Path. If the Path is on the same partition as the OS, this is a finding.

Fix Text (F-20223r311155_fix)

Follow the procedures below for each site hosted on the IIS 10.0 web server: Open the IIS 10.0 Manager. Click the site name under review. Click the "Advanced Settings" from the "Actions" pane. Change the Physical Path to the new partition and directory location.