need help testing web server security

[muddyjohn]

Could anyone tell me the best way to test Microsoft web servers running on win 2k server? I need to find out if they need patches or have security holes. Any ideas out there?

thanks

Hold on! This could Hurt! I ain't certified by Microsoft!

http://www.Muddycomputers.com

 

[Shift838]

Well you can install the IIS lockdown tool and the URL Scan from Microsoft. Also there is a product called Retina that does security scanning for ports, etc..

 

[epohl]

You can also use the Microsoft Baseline Security Analyzer to determine if you are missing any patches. But I agree with Chris that you should also use the IIS lockdown tool and then definitely use a third party scanner like retina or nessus to scan for vulnerabilities if this box will be on the internet.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/mbsahome.asp

 

[muddyjohn]

Thanks for the info

Hold on! This could Hurt! I ain't certified by Microsoft!

http://www.Muddycomputers.com