How to disable TRACE/TRACK in IIS 7.5

Question

From this article : Disable Trace/Track in IIS | Techstacks HOWTO's, I came to know that you need to install UrlScan Filter to disable TRACE/TRACK requests on IIS 7.5. However, I had trouble installing UrlScan Filter (I'm not a .NET developer) -- Microsoft UrlScan Filter v3.1 Setup Wizard fails with message IIS Metabase is required | Server Fault.

Are there other ways of disabling TRACE/TRACK requests ?

Chun Liu · Accepted Answer · 2018-02-12T05:24:29.057

2

On IIS 7.0 or later, it didn't rely on UrlScan anymore. You can configure <requestFiltering> to DENY the verb TRACE. For example, in your web.config:

<configuration>
   <system.webServer>
      <security>
         <requestFiltering>
            <verbs>
               <add verb="TRACE" allowed="false" />
            </verbs>
         </requestFiltering>
      </security>
   </system.webServer>
</configuration>

You can find details here: https://docs.microsoft.com/en-us/iis/configuration/system.webServer/security/requestFiltering/verbs/

edited Feb 12 '18 at 05:24

answered Feb 12 '18 at 05:19

Chun Liu

426
2
7

Tried the instructions in the link above but the results are not per expectations. How do we fix this ? – anjanb Mar 06 '18 at 14:32
if these instructions didn't work, what would I do ? – anjanb Mar 14 '18 at 16:08
1

Then you should troubleshoot why it doesn't work. Maybe you can start with IIS log. – Chun Liu Mar 15 '18 at 08:05

score 1 · Answer 2 · answered Jul 25 '19 at 15:49

If anyone is still having difficulty disabling TRACE/TRACK verbs, here are the instructions to do it via IIS Manager:

Go to IIS Manager
Click the website name
Double click “Request Filtering” (If you don’t see Request Filtering icon, please install it)
Go to “HTTP Verbs” tab
Click “Deny Verb” from the Actions menu. Type “TRACE”. Click “OK”
Click “Deny Verb” from the Actions menu. Type “TRACK”. Click “OK”

Please note that TRACK verb is disabled by default after IIS 7. TRACE is disabled as well except IIS 8.5:

For more information on this topic: How to disable HTTP TRACK and TRACE verbs in IIS?

How to disable TRACE/TRACK in IIS 7.5

2 Answers2