The wonders of "security by default", the Microsoft way.

[theweaselking]

Ah, yes, of course. You've included no less than 4 full virtual webservers with Sharepoint enabled, and you tried to install sExchange and told me that I should disable my DHCP server and firewall, but ASP? That's just insecure, man! You've GOTTA disable serving of ASP pages even when they're specifically added to the web folder and made available, with a 404 error - because, you know, with ultra-verbose maximum-information errors and logging, it might be BAD to possibly tell the SYSTEM ADMINISTRATOR that you've found the page but aren't serving it because you've determined that ASP is insecure while ASPX is just totally okay. You don't even have to throw a line into the log files!

I hate Server 2003.

I really, really hate default behaviours that don't make sense and aren't covered in the setup instructions.

Comments

[mcfnord.livejournal.com]

i write those setup instructions. i would include this warning. but microsoft didn't hire me for this job.