To install URLScan automatically, use the IIS Lockdown Wizard, which is included in the IIS Lockdown tool. The wizard asks you which type of Web server you're running and which IIS-related products (e.g., Microsoft FrontPage Server Extensions, Microsoft Commerce Server) are installed. The wizard then attempts to lock down your server without breaking any functionality that your installed tools and products require. The wizard installs URLScan, disables specified script mappings (for information about these script mappings, go to http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/tools//locktool.asp), disables specified services, removes specified folders that contain dangerous sample content (from the default installation of IIS), and strengthens file permissions to prevent anonymous users from writing to content directories and running system utilities.
If using the IIS Lockdown Wizard breaks your Web site, simply run the wizard again. Answer Yes to the question Do you want to restore your original settings? that you see on the first page of the wizard when you rerun it, and the wizard will restore your original settings.
