Removing IIS headers

Posted by Certain_Square743@reddit | sysadmin | View on Reddit | 11 comments

I know this has been asked all over the net but I am now stuck. A recent pen test has shown some low value results because headers are been exposed, yes I know many people say this don't matter, but it does to us so please help.

So at first the response when scanning our test machine was "443/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)" we did the reg key change (https://learn.microsoft.com/en-gb/archive/blogs/dsnotes/wswcf-remove-server-header) and the scan now shows "443/tcp open ssl/upnp Microsoft IIS httpd". I have tried everything I can find online about how to remove this header info but nothing works. I have put URLrewrite on the test machine and created the rules as per Microsoft documentation (https://learn.microsoft.com/en-gb/archive/blogs/varunm/remove-unwanted-http-response-headers) but that has made no difference either the header still shows as Microsoft IIS httpd how can I get rid of this any ideas ?