IIS / Web Server¶

# Verify W3SVC service registration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\W3SVC"

# Check WAS service configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\WAS"

# Check if a .NET profiler is globally configured (common with APM tools)
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" |
    Select-Object COR_ENABLE_PROFILING, COR_PROFILER, COR_PROFILER_PATH

# Check IIS worker process crash protection
$iisRegPath = "HKLM:\SOFTWARE\Microsoft\InetStp"
Get-ItemProperty $iisRegPath | Select-Object MajorVersion, MinorVersion, VersionString

# List all SSL certificate bindings managed by HTTP.sys
netsh http show sslcert

# List all certificates in the machine personal store with their thumbprints
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates" |
    ForEach-Object { $_.PSChildName }

# Bind a new SSL certificate to port 443
$certHash = "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2"
$appId = "{4dc3e181-e14b-4a21-b022-59fc669b0914}" # IIS App ID

netsh http add sslcert ipport=0.0.0.0:443 certhash=$certHash appid=$appId certstorename=MY

# Read current HTTP.sys parameters
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters"

# Increase max header size to 64 KB (for large JWT/auth cookies)
$httpParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters"

Set-ItemProperty -Path $httpParamsPath -Name "MaxFieldLength" -Value 65534 -Type DWord
Set-ItemProperty -Path $httpParamsPath -Name "MaxRequestBytes" -Value 65534 -Type DWord

# Restart HTTP.sys to apply changes (WARNING: drops all active connections)
Restart-Service HTTP -Force

# Check the kernel request queue length (per app pool)
$httpParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters"
Get-ItemProperty $httpParamsPath -Name "RequestBufferSize" -ErrorAction SilentlyContinue

# Create or modify connection limits
$httpParamsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters"

# Max concurrent connections per server (0 = unlimited)
Set-ItemProperty -Path $httpParamsPath -Name "MaxConnections" -Value 10000 -Type DWord

# Connection timeout in seconds (idle connections)
Set-ItemProperty -Path $httpParamsPath -Name "IdleConnectionsHighMark" -Value 512 -Type DWord
Set-ItemProperty -Path $httpParamsPath -Name "IdleConnectionsLowMark" -Value 256 -Type DWord

# Set the TCP listen backlog for high-traffic servers
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters" `
    -Name "ListenBackLog" -Value 1024 -Type DWord

# Disable WebDAV methods at the HTTP.sys level via IIS config
# (This is the recommended approach via web.config, shown here for reference)
# HTTP.sys itself doesn't filter verbs — this is done in applicationHost.config

# Verify request filtering module is loaded
Get-WebConfigurationProperty -Filter "system.webServer/security/requestFiltering/verbs" `
    -PSPath "MACHINE/WEBROOT/APPHOST" -Name "Collection" |
    Format-Table verb, allowed

# Disable TLS 1.0 completely (server-side and client-side)
$protocols = @("TLS 1.0")
$sides = @("Server", "Client")

foreach ($protocol in $protocols) {
    foreach ($side in $sides) {
        $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$protocol\$side"

        if (-not (Test-Path $regPath)) {
            New-Item -Path $regPath -Force | Out-Null
        }

        Set-ItemProperty -Path $regPath -Name "Enabled" -Value 0 -Type DWord
        Set-ItemProperty -Path $regPath -Name "DisabledByDefault" -Value 1 -Type DWord
    }
}

# Ensure TLS 1.2 and TLS 1.3 are explicitly enabled
$protocols = @("TLS 1.2", "TLS 1.3")
$sides = @("Server", "Client")

foreach ($protocol in $protocols) {
    foreach ($side in $sides) {
        $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$protocol\$side"

        if (-not (Test-Path $regPath)) {
            New-Item -Path $regPath -Force | Out-Null
        }

        Set-ItemProperty -Path $regPath -Name "Enabled" -Value 1 -Type DWord
        Set-ItemProperty -Path $regPath -Name "DisabledByDefault" -Value 0 -Type DWord
    }
}

# Audit all Schannel protocol states
$basePath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"

Get-ChildItem $basePath -Recurse |
    Where-Object { $_.Property -contains "Enabled" } |
    ForEach-Object {
        [PSCustomObject]@{
            Protocol = $_.PSPath -replace '.*Protocols\\', ''
            Enabled  = $_.GetValue("Enabled")
            DisabledByDefault = $_.GetValue("DisabledByDefault")
        }
    } | Format-Table -AutoSize

# List currently enabled cipher suites
Get-TlsCipherSuite | Select-Object Name, CipherSuite | Format-Table -AutoSize

# Audit TLS protocol state across all IIS servers
$servers = Get-Content "C:\Admin\iis-servers.txt"

$results = Invoke-Command -ComputerName $servers -ScriptBlock {
    $basePath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"
    $protocols = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1", "TLS 1.2", "TLS 1.3")

    foreach ($protocol in $protocols) {
        $serverPath = Join-Path $basePath "$protocol\Server"
        $enabled = "Not configured"

        if (Test-Path $serverPath) {
            $val = Get-ItemProperty $serverPath -Name "Enabled" -ErrorAction SilentlyContinue
            if ($null -ne $val.Enabled) {
                $enabled = $val.Enabled
            }
        }

        [PSCustomObject]@{
            Server   = $env:COMPUTERNAME
            Protocol = $protocol
            Enabled  = $enabled
        }
    }
}

$results | Format-Table Server, Protocol, Enabled -AutoSize

# Enable Schannel event logging (level 3 = warnings + errors + informational)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" `
    -Name "EventLogging" -Value 3 -Type DWord

# Check Schannel events for TLS 1.0 connections (Event ID 36880)
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'Schannel'
    Id = 36880
} -MaxEvents 20 | Select-Object TimeCreated, Message | Format-List

# Harden TLS configuration on all IIS servers
$servers = Get-Content "C:\Admin\iis-servers.txt"

Invoke-Command -ComputerName $servers -ScriptBlock {
    $schannelBase = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"

    # Protocols to disable
    $disableProtocols = @("SSL 2.0", "SSL 3.0", "TLS 1.0", "TLS 1.1")
    # Protocols to enable
    $enableProtocols = @("TLS 1.2", "TLS 1.3")

    foreach ($protocol in $disableProtocols) {
        foreach ($side in @("Server", "Client")) {
            $path = "$schannelBase\$protocol\$side"
            New-Item -Path $path -Force | Out-Null
            Set-ItemProperty -Path $path -Name "Enabled" -Value 0 -Type DWord
            Set-ItemProperty -Path $path -Name "DisabledByDefault" -Value 1 -Type DWord
        }
    }

    foreach ($protocol in $enableProtocols) {
        foreach ($side in @("Server", "Client")) {
            $path = "$schannelBase\$protocol\$side"
            New-Item -Path $path -Force | Out-Null
            Set-ItemProperty -Path $path -Name "Enabled" -Value 1 -Type DWord
            Set-ItemProperty -Path $path -Name "DisabledByDefault" -Value 0 -Type DWord
        }
    }

    Write-Output "$env:COMPUTERNAME : TLS hardening applied"
}

# Force .NET Framework 4.x to use TLS 1.2 by default
$netFxPaths = @(
    "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319"
)

Invoke-Command -ComputerName $servers -ScriptBlock {
    param($paths)
    foreach ($path in $paths) {
        if (-not (Test-Path $path)) {
            New-Item -Path $path -Force | Out-Null
        }
        # SchUseStrongCrypto forces TLS 1.2 for outbound connections
        Set-ItemProperty -Path $path -Name "SchUseStrongCrypto" -Value 1 -Type DWord
        # SystemDefaultTlsVersions defers to the OS default TLS version
        Set-ItemProperty -Path $path -Name "SystemDefaultTlsVersions" -Value 1 -Type DWord
    }
    Write-Output "$env:COMPUTERNAME : .NET TLS 1.2 enforced"
} -ArgumentList (,$netFxPaths)

# Restart servers (schedule during maintenance window)
$servers | ForEach-Object {
    Restart-Computer -ComputerName $_ -Force -Wait -For WinRM -Timeout 300
    Write-Output "$_ : Restarted"
}

# Validate TLS configuration post-reboot
Invoke-Command -ComputerName $servers -ScriptBlock {
    $basePath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols"
    $check = @("TLS 1.0\Server", "TLS 1.1\Server", "TLS 1.2\Server", "TLS 1.3\Server")

    foreach ($sub in $check) {
        $path = Join-Path $basePath $sub
        $enabled = (Get-ItemProperty $path -Name "Enabled" -ErrorAction SilentlyContinue).Enabled
        Write-Output "$env:COMPUTERNAME | $sub | Enabled=$enabled"
    }
}