IIS Config - PROPFIND, OPTIONS verbs are ignored and treated as GETs?

Question

I'm attempting to configure a webdav server example application ( https://sourceforge.net/projects/webdav/ ) to run on IIS6 (Win2003 Server). The application runs correctly on my dev machine (Win7, IIS7.5).

When I attempt to map a drive to the DAV share, several requests are issued, including one OPTIONS request and two PROPFIND requests.

In Fiddler, I see that these are transmitted correctly. However, the response is always the content of the default page on the site. If I look at the IIS logs, the requests are logged as GETs instead of OPTIONS or PROPFIND.

UrlScan is disabled, but I went ahead and added OPTIONS and PROPFIND to the list of allowed verbs (since I'm running out of ideas).

Help.

Answer 1

Solved.

Turns out that URLScan wasn't disabled, though it was not listed in the ISAPI filter list in IIS Manager. Just for kicks I renamed the URLScan.ini file, which resulted in an exception when any site on the server was hit.

Rather than removing URLScan completely (following the Prime Directive), I modified the denyVerbs and DenyHeaders sections to allow all of the DAV stuff.

I'll accept an answer from the first person to provide a clear explanation of what security problems this may introduce if put in production.