In this article
IIS is relatively secure with its base configuration. As it is module based, only required modules need to be installed, thereby limiting the surface area for potential attacks against the service.
Moving the Web Root
By default, IIS installs its web root folder on the system drive. If an attacker were to be able to hack a page residing on the system drive, using folder traversal could potentially give the attacker access to system files. Forsta recommends moving the web root folder to a different drive, and installing Forsta Plus on a different drive than the operating system as well. Scripts for performing an IIS folder migration can be found around the Internet. Alternatively, the official steps from the IIS blog may be used: