WA000-WI6040 IIS6 - A unique non-privileged account must be used to run Worker Process Identities. - 'AppPoolIdentityType = 3 - WAMUserName'

Information

The Worker Process Identity is the user defined to run an Application Pool. The IIS 6 worker processes, by default, run under the NetworkService account. Creating a custom identity for each Application Pool better track issues occurring within each web site. When a custom identity is used, the rights and privileges must not exceed those associated with the NetworkService security principal.

NOTE: Review each website's AppPoolIdentityType to ensure it is a non-privileged account.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. Open the IIS Manager > Right click on the Application Pool that corresponded to the website being reviewed > Select Properties > Select the Identity tab.
2. Enter the desired account information.
3. Check the privileges on the account found in step 2 by using Computer Management and opening Users and Groups.
4. Ensure the account is a member of the IIS_WPG group and does not have membership to the Administrators group.

See Also

http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, CAT|I, Rule-ID|SV-38046r1_rule, STIG-ID|WA000-WI6040_IIS6, Vuln-ID|V-13713

Plugin: Windows

Control ID: e628261ae2ceab64223bd448af9906df40608adcfa557d8829ad70c7ce24efb3