For this issue, I wanted to write about a Windows Script Host (WSH) script that enumerated every object in the default Web site, then displayed the authentication mode for each object. IIS administrators can use this tool for auditing a Web site for security holes. Notice that I said I "wanted" to write about this tool: I'll tell you why I didn't get around to it in a minute.
When I was researching the article I intended to write, I couldn't find the IIS metabase enumerator code that I needed for the foundation of the program. I know how to instantiate and use the COM objects necessary for displaying the authentication method, but I needed the enumerator code to iterate and identify each object (e.g., .asp, .htm, .jpg, .gif files) on a Web site that has Anonymous access. I've seen and used this code several times, but I'm not the type of programmer who memorizes syntax (if you know what I mean). So, I searched my Microsoft Developer Network (MSDN) Universal DVD thinking that I could nail it quickly. My search yielded 163 matches. After going through the first 10 matches and not finding the code snippet I needed, I got impatient and decided to search my Windows 2000 Advanced Server (Win2K AS) for *.vbs. I thought that in the approximately 20 WSH scripts on my server, I'd find one that enumerates the IIS metabase; from there, I could figure out how to enumerate every resource on a Web site.
My search for *.vbs yielded 447 files. (Granted, I have Microsoft Site Server, Microsoft SQL Server, and the Microsoft Windows 2000 Resource Kit installed on my Win2K server, but I'm still shocked at the incredible wealth of WHS scripts on my server.) Four hours later, after playing around with all the great WSH scripts I found (I only made it through 25 percent of them), I realized that I had to get this article out before my editor wrung my neck.
Here's my call to action: Search your server (Windows NT 4.0 or Win2K) for *.vbs. You'll be amazed at the breadth and depth of great WSH script code you'll find just waiting for IIS administrators like you to implement. (Note: Don't run any .vbs script before first opening it to read what it does. The disastrous implications of running something accidentally under an administrative security context are significant.) Most of the WSH scripts on your server are well documented within the code. Most of the WSH code you find on your server will run in Help mode if you don't supply parameters, but don't count on that. Open the scripts first, then read the comments about their functionality before running them.
I didn't get around to showing how to do what I intended in this article, but between now and the next issue I'll figure out how to enumerate the resources on a Web site to display the authentication on every resource that has Anonymous access. You'll be able to use that tool for security auditing. Who knows? That WSH script might already be on your server. I have 75 percent of the WSH scripts on my server to sift through and 2 weeks to find out.