Information
customErrors can be set to On or RemoteOnly without leaking detailed application information to the client. Ensuring that customErrors is not set to Off will help mitigate the risk of malicious persons learning detailed application error and server configuration information.
Solution
customErrors may be set for a server, site, or application using the IIS Manager GUI, using AppCmd.exe commands in a command-line window, directly editing the configuration files, or by writing WMI scripts. Perform the following to set the customErrors mode to RemoteOnly or On for a Web Site in the IIS Manager GUI: Open the IIS Manager GUI and navigate to the site to be configured In Features View, find and double-click .NET Error Pages icon In the Actions Pane, click Edit Feature Settings In modal dialog, choose On or Remote Only for Mode settings Click OK