IISreset creates web.config under the wwwroot dir

Question

IISreset creates web.config under the wwwroot dir. Anyone know why this would happen? it's creating a vulnerability.

thanks

Answer 1

IIS should only generate web.config when it need to apply some configuration change in site level. Please check what was logged in that web.config and did you enable always running for your web application in Default Web Site.

Besides, Microsoft Prcocess monitor will display the process that created web.config. Please create a filter for "Path contains wwwroot\web.config".

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon