Extracting URLScan

We want to install URLscan on the server, but we don't want to run the IISLockdown tool. Previously, Microsoft provided these tools separately, but now they are all in the same installation. How can I install both URLScan and IISLockdown?

A: As you said earlier, Microsoft previously released the IIS Lockdown tool and URLScan separately. Version 2.1 of the IIS Lockdown tool includes URLScan 2.0 after the update. In most cases, the IIS Lockdown Wizard should run on the IIS server. This will perform several important steps to enhance the security of your server and will configure and install the URLScan ISAPI filter.

The URLScan component can be extracted from the IIS Lockdown installation package and installed without running IIS Lockdown. This will provide you with version 2.0 of URLScan instead of version 1.0; at the time of this writing, version 1.0 will still be available as a separate downloadable download from Microsoft's download page and through many Microsoft Knowledge Base articles.

To extract URLScan from IISLockdown 2.1, first download IISLockdown 2.1. Then open a command prompt window at the location of the tool and type the following command:

iislockd.exe /q /c /t:c:\\lockdown_files

This command will be extracted from the installation package these files. You can then install URLScan.dll as an ISAPI filter at the WWW Master property level. Make sure that the URLScan.ini file is stored in the same location as the URLScan.dll file.

You will most likely need to manually configure the URLScan.ini file for your server. We recommend that only experienced administrators can edit the URLscan.ini file. Read the instructions in the URLScan.doc file extracted from the IIS Lockdown utility. One of the benefits of running the IISLockdown Tool Wizard to install URLScan is that it configures the URLScan.ini file for you.