Disabling Classic ASP without disabling ASP.NET on IIS

Question

BTW this is not something I am want but is a requirement I must follow . My requirement is to create a user interface that will allow users to disable Classic ASP while allowing ASP.NET 1-4 applications run. Can anyone think of a use case were a user would want to do this?

Answer 1

Sure, if you were a web-host offering partial access to a webserver through an application that emulated some of the relevant IIS options, then not only would customers not want the added risk of unneeded script/executable systems running, but you wouldn't either, so you'd want it turned off unless they went in and explicitly turned it on because they needed it.

Indeed, software for this use-case already exists.

Answer 2

Jon's comments about reducing a site's attack surface by removing unwanted features is very valid. You should ideally just run what you need and no more.

There are a number of ready made commercial solutions to this problem such as Plesk, but they may provide too much functionality for your needs.

You could write your own functionality:

If this is IIS6 then you should take a look at the ADSI API which is surfaced via the System.DirectoryServices namespace:

Using System.DirectoryServices to Configure IIS

To enable/disable scriptmaps you need to manipulate the ScriptMaps metabase property for a site:

ScriptMaps Metabase Property (IIS 6.0)

If this is IIS7 then take a look at the Microsoft.Web.Administration managed API. In IIS7 you want to manipulate the handler mappings for a site:

Handlers <handlers> - IIS.NET

In all cases, the user must be a member of the machine's Administrators group.