AppLock/Web for IIS

Microsoft Windows NT® Server 4.0, with its built-in Web server, Internet Information Server (IIS) 4.0, and Microsoft Windows® 2000, with its built-in Web server, Internet Information Services (IIS) 5.0, publish information and bring business applications to the Web.

WatchGuard AppLock/Web for IIS is designed to secure the Windows NT or Windows 2000 operating system on your Web server, the Microsoft IIS application files and registry keys, and the files that make up your Web site.

When you install WatchGuard AppLock/Web and restart your server, the AppLock/Web protections are on. Your server and your Web site are secure.


Protections

Microsoft® Windows NT® Server 4.0, with its built-in Web server, Internet Information Server (IIS) 4.0, and Microsoft® Windows® 2000, with its built-in Web server Internet Information Services (IIS) 5.0, publish information and bring business applications to the Web. The number of protected files affects the memory requirements of AppLock/Web. AppLock/Web requires 128 MB RAM to protect 5000 or fewer files and 256 MB RAM to protect between 5000 and 15,000 files.

WatchGuard AppLock/Web for IIS provides three types of protections:

  • Operating System

  • Microsoft IIS Directories and Files

  • Web Site File Protections

Warning: Using the Microsoft remote management interfaces for Microsoft IIS (MMC Snap-In for IIS and Internet Services Manager) exposes your Web server to unauthorized configuration changes of your active server data. While all of your AppLock/Web-protected content remains secure, the configuration changes could result in a redirection of requests for that content. To eliminate this vulnerability, Microsoft recommends reviewing the following checklists:

Secure Internet Information Services 5 Checklist

http://www.microsoft.com/technet/security/iis5chk.asp

Microsoft Internet Information Server 4.0 Security Checklist

http://www.microsoft.com/technet/security/iischk.asp


System Requirements

To run AppLock/Web, your server must meet the following minimum requirements:

Software | Hardware
One of the following: Microsoft® Internet Information Server (IIS) 4.0 for Windows NT® 4.0 Microsoft® Internet Information Services (IIS) 5.0 for Windows® 2000 | 200 MHz Pentium II or faster
One of the following operating systems: Windows NT® Workstation 4.0 Windows NT® Server 4.0 Microsoft® Windows NT® Server 4.0 Terminal Server Edition Windows NT® Server 4.0 Enterprise Edition Windows® 2000 Professional Windows® 2000 Advanced Server Windows® 2000 Server (See Note regarding non-English operating systems.) | 128 MB RAM to protect 5000 or fewer files. 256 MB RAM to protect between 5000 and 15,000 files.
Service Pack 4 (or later) for Windows NT 4.0 | 6 MB of free disk space
TCP/IP network | CD-ROM drive (for installation from CD)
NTFS file system |
Microsoft Internet Explorer 4.x or later and the latest version of HHUPD.EXE, available from the Microsoft Web site (required for online Help) |

Note: Although WatchGuard has not translated the AppLock/Web graphical user interface, AppLock/Web runs on the Japanese, German, and Spanish versions of Windows NT and Windows 2000. AppLock/Web, neither internationalized nor localized, does not support Unicode and does not interact with non-English file system names or registry names.


Running the AppLock/Web Installation

After you ensure that your system meets the minimum requirements, you can begin the AppLock/Web installation. WatchGuard uses an InstallShield® Wizard to guide you through the AppLock/Web installation.

  1. Insert the AppLock/Web CD into your CD-ROM drive. The CD must be available from either a local or remotely mounted CD-ROM drive.

  2. An AutoRun program automatically launches the AppLock/Web Setup.

If AutoRun is disabled, follow these steps to run Setup:

From the Start menu, click Run.

Type <CD-ROM Drive>:\Setup.exe or click Browse to find this file on the CD.

  3. The Setup program begins by displaying the Welcome dialog box. Read the text and note that the installation forces a restart of your computer.

  4. Enter the License Key found on your on your WatchGuard AppLock/Web CD jewel case.

  5. When the License Agreement dialog box appears, read the agreement carefully. If you accept the license, click Yes to continue with the installation. If you click No, the installation terminates.

  6. The Destination Folder dialog box identifies the AppLock/Web default installation directory (<target drive>:\Program Files\WatchGuardSSD\AppLock/Web ). Click Next to choose the default location for the AppLock/Web installation or click Browse to select a different folder. The AppLock/Web Setup automatically creates the default or custom folder.

  7. The Installation Information dialog box summarizes the choices you made for the installation. Read them carefully. Click Next to install AppLock/Web. Click Back to make any changes.

  8. Type and confirm a password that you will use whenever you log in to AppLock/Web. The AppLock/Web password must be a strong password requires:

  9. During AppLock/Web installation, you can register for LiveSecurity™. LiveSecurity registration is required for technical support.
    Click Register Now to launch Internet Explorer and register now through the LiveSecurity Web site (www.watchguard.com/support).
    Click Register Later to register at another time. To register later, right-click the AppLock/Web System Tray icon and choose Launch LiveSecurity to register through the LiveSecurity Web site.

  10. Click Finish. Your computer restarts, enabling protection.

Your AppLock/Web protections are not enabled until your computer restarts.


Removing AppLock/Web

To remove AppLock/Web from your computer, use Add/Remove Programs in the Windows Control Panel or run Setup.exe from the CD-ROM.

To remove AppLock/Web from your computer, you must enter the AppLock/Web password.

  1. Open Control Panel and double-click the Add/Remove Programs icon. The Add/Remove Programs dialog box opens.

  2. Select AppLock/Web and then click Change/Remove.

  3. The Welcome dialog box appears. Read the text and note that the removal forces a restart of your computer.

  4. Click Yes to remove the profile or No to keep the profile.

If your server runs the Windows NT® operating system, the AppLock/Web installation created an AppLock/Web Recovery hardware profile. You can remove this profile when removing AppLock/Web.

If you made changes to this profile, you might not want to remove it. If you did not make changes to this profile, you can remove it.

Note: If your server runs the Windows® 2000 operating system, the AppLock/Web installation did not create a hardware profile. When you run the AppLock/Web removal, this dialog box does not appear.

  5. Type your password to remove AppLock/Web. If you forgot your password, you can reset your password.

  6. After AppLock/Web uninstalls, you must restart your computer. Click Finish to restart.


Protection States

When running AppLock/Web, a server is defined to be in one of two states, locked or unlocked.

Icon | Description
 | When a server is locked, the AppLock/Web protections are on. Your Web server is secure.
 | When a server is unlocked, the AppLock/Web protections are off. Your Web server is vulnerable.


Performing Administrative Tasks

Before you perform an administrative task, such as publishing new information to your Web site or changing the configuration of a protected computer, you must first unlock the server.

Unlocking your server makes your system vulnerable. For absolute security, WatchGuard recommends that you remove your system from the network before unlocking the server, and relock your server before returning it to the network.

  1. Double-click the System Tray icon to open the AppLock/Web user interface. Alternatively, click Programs from the Start menu and choose WatchGuard AppLock Web.

  2. When prompted, type the password created during installation.

  3. Click Unlock the Server to turn protections off.

  4. Perform your Web site update or other administrative task, and save the changes.

  5. Click Lock the Server. AppLock/Web runs AutoDiscovery, searching all the files within your Web site to find if any files were added or removed. It then updates the list of Web site file protections.
    When AutoDiscovery finishes, the lock on the AppLock/Web dialog box closes, indicating that the server is locked and the protections are on.

  6. Click Close. Your server and your Web site are secure.


AppLock/Web and Software Installations

Most software installations require changes in the system files and registry. Because AppLock/Web prevents changes to operating system resources, you must disable AppLock/Web when you install new software or update your computer.

When an installation warns that you must restart the computer to complete the installation, you must leave AppLock/Web unlocked until the restart and installation are complete. This allows the installation program to add or remove the necessary files after the restart.

Installing Software That Does Not Require a Restart

Installing Software That Requires a Restart


Changing Passwords

Changing Your Password

Your password is important; it stops others from gaining access to your systems. If you have a new AppLock/Web administrator, it is advisable to create new passwords.

  1. Click Change Password on the Login dialog box.

  2. Type your old password.

  3. Type and confirm a new password.

  4. Click OK to change the password.

  5. In the Login dialog box, type the new password.

  6. Click Close on the AppLock/Web dialog box,

If you forget your AppLock/Web password, you must reset the password to perform AppLock/Web functions.


Starting AppLock/Web

You can open the main dialog box in several ways:

  • Double-click the System Tray icon

  • Right-click the System Tray icon to display the menu and choose Manage AppLock/Web

  • Click Programs from the Start menu and choose WatchGuard AppLock Web.

You can turn off AppLock/Web protections, run AutoDiscovery, or make changes to the AppLock/Web protections from the AppLock/Web dialog box.


System Tray Icon

The AppLock/Web installation adds an icon to the System Tray that you use to open the AppLock/Web user interface and to monitor the protection state of the server.

The color of the icon indicates the current protection state. You can also pause the mouse over the System Tray icon to display a ToolTip that identifies the state of protection and authentication. Double-click the System Tray icon to open the AppLock/Web dialog box.

If you right-click the System Tray icon, you can access a menu that contains the following options:

  • Manage AppLock/Web for IIS

  • About AppLock/Web for IIS

    • View Protections

  • Launch LiveSecurity


Viewing and Editing Protections

To see the files protected by AppLock/Web or make changes to the list of protected files, open View/Edit Protections.

  1. Double-click the AppLock/Web System Tray icon to open the AppLock/Web dialog box. Alternatively, you can click Programs from the Start menu and choose WatchGuard AppLock Web.

  2. Type your password.

  3. On the AppLock/Web dialog box, click View/Edit Protections.

  4. AppLock/Web displays the Discover New Web Site Files dialog box. Click Yes or No.

If you click No, AppLock/Web does not run AutoDiscovery. The View/Edit Protections dialog box displays the list of current protections.

If you click Yes, AppLock/Web runs AutoDiscovery. When the discovery process is complete, click Close. The View/Edit Protections dialog box displays current protections and newly discovered files.

  5. AppLock/Web displays the View/Edit Protections dialog box.


Monitoring the Protection State

AppLock/Web provides color cues on the System Tray icon to identify the protection state of your server.

System Tray Icon and Color | Description
 | The server is locked and you are not logged in to AppLock/Web
 | When you log in to AppLock/Web, the System Tray icon turns yellow.
 | When you unlock your server, the yellow System Tray icon lock opens. The server is vulnerable
 | If you close AppLock/Web without relocking the server, the System Tray icon changes to red to indicate that the server is vulnerable.


AutoDiscovery

The AppLock/Web AutoDiscovery automatically searches for and protects Web content with more than 200 known file extensions. When you click Lock the Server, AppLock/Web scans your Web site files and compares them to a list of common Web site file extensions. It then locks down all your Web site files that match the types on the list.

Each time you make changes to your Web site files, click Lock the Server to run AutoDiscovery and update AppLock/Web protections.

Important: AutoDiscovery does not search for changes to the operating system or Microsoft IIS application files and registry keys.


Changing File Protections

In the View/Edit Protections dialog box:

  1. Protect or unprotect any discovered file by selecting or clearing the check boxes in the Protect column.

  2. Right-click any file or group of files (select several files by holding down the SHIFT or CTRL key as you click the files you want to select) in the Files Pane or any folder in the Folders Pane to display a pop-up menu.

  3. Choose Protect All to select all the check boxes for those files or Unprotect All to clear all the check boxes for those files.


Saving Changed File Protections

View/Edit Protections Dialog Box

When you finish editing the AppLock/Web protections, you must save your changes. If you click Cancel your changes are not saved.

  1. Click OK to save these changes.

  2. Click Lock the Server to turn protections on.

Warning: If you close AppLock/Web without clicking Lock the Server, your files are not protected and your Web site is vulnerable.


Restoring Default Protections

Restore Defaults automatically protects all recognized Web site files and unprotects any other files that are not recognized as Web site files.

Warning: AppLock/Web warns you that any changes you previously made to your Web site protections are lost.

  1. Click Restore Defaults in the View/Edit Protections dialog box.

  2. Click Yes or No at the warning.

If you click Yes, AppLock applies the default protections, protecting all recognized Web site files.

Click No to leave protections unchanged.

  3. Click OK on the View/Edit Protections Dialog box to save these changes.

  4. Click Lock the Server to enable the protections.

Note: Files are not protected until you save the changes and Lock the Server.


Windows Event Log

The Windows Event Log, which starts automatically when you run a Windows NT® or Windows 2000® operating system, records events in your system. The Event Viewer allows you to monitor these events. You can use the Event Viewer to view and manage System, Security, and Application event logs. You can also archive event logs.

Changes to the protection state are recorded in the Windows Event Log. If the AppLock/Web System Tray icon fails, it is logged to the Application Event Log. Whenever access to a protected file is denied by AppLock/Web, it is logged in the System Event Log. Note that AppLock/Web does not log to the Security Event Log.


Disabling AppLock/Web

To reset your AppLock/Web password, you must disable AppLock/Web by starting the server in the Windows® 2000 Safe Mode or with the AppLock/Web Recovery hardware profile if your server is running Windows NT®.


Password Reset

If you have forgotten your AppLock/Web password, the Password Reset utility lets you create a new password to re-gain access to AppLock/Web. When you installed AppLock/Web, the Password Reset utility was installed on your server.

Before running the Password Reset utility, make sure you start your computer with the AppLock/Web Recovery hardware profile on a Windows NT® server, or in Safe Mode on a Windows® 2000 server.

  1. Locate Password Reset (passwordreset.exe), installed on your server.

  2. Type <Drive>:\Program Files\WatchGuardSSD\passwordreset.exe or click Browse to find this file on the server.

  3. In the Password Reset dialog box, type and confirm a new password. The password must be a strong password.

  4. Click OK. Your server restarts.


Protected File Types

When you run AutoDiscovery, AppLock/Web searches through your Web site files and compares those files to a list of commonly used Web site file types.

AppLock/Web protects files with the following extensions:

323 | acx | ai | aif | aifc | aiff | asa | asf
asp | asr | asx | au | avi | axs | bas | bat
bcpio | bmp | c | cab | cat | cdf | cer | cfm
cfml | class | clp | cmx | cod | cpio | crd | crl
crt | csh | css | dcr | der | dir | dll | dms
doc | dot | dvi | dxr | eps | etx | evy | exe
fif | fla | flr | gif | gtar | gz | h | hdf
hlp | hqx | hta | htc | htm | html | htt | ico
ief | iii | ins | isp | jar | jfif | jpe | jpeg
jpg | js | jsp | latex | lha | lsf | lsx | lzh
m13 | m14 | m3u | man | mdb | me | mht | mhtml
mid | mny | mov | movie | mp2 | mp3 | mpa | mpe
mpeg | mpg | mpp | mpv2 | ms | mvb | nws | oda
p10 | p12 | p7b | p7c | p7m | p7r | p7s | pbm
pdf | perl | pfx | pgm | pko | pl | pma | pmc
pml | pmr | pmw | png | pnm | pot | ppm | pps
ppt | prf | ps | pub | py | qt | ra | ram
ras | rgb | rmi | roff | rtf | rtx | scd | sct
setpay | setreg | sgml | sh | shar | shtm | shtml | sit
snd | spc | spl | sql | src | sst | stl | stm
sv4cpio | sv4crc | t | tar | tcl | tex | texi | texinfo
tgz | tif | tiff | tr | trm | tsv | txt | uls
ustar | vbs | vcf | vrml | wav | wcm | wdb | wks
wmf | wps | wri | wrl | wrz | xaf | xbm | xla
xlc | xlm | xls | xlt | xlw | xml | xof | xpm
xwd | z | zip |  |  |  |  |


Troubleshooting the Installation

The following list identifies possible installation problems, explains what they mean, and provides tips for resolving problems.

Problem: | Action to take:
If you attempt to re-install AppLock/Web without restarting the computer after removing a partial install or after a partial install, an error message appears stating that the drivers could not be started. | Restart the server. If this problem continues, contact WatchGuard Technical Support.
An error message appears indicating that there was insufficient memory to run installation. | Make sure there is enough disk space on your hard drive. The installation stores files in a temporary directory.
An error message appears indicating that the installation failed to create folders or icons. | Make sure that you have Administrator privileges on the server on which you are installing AppLock/Web.
An error message appears that a volume cannot be protected. | WatchGuard AppLock/Web can only protect NTFS volumes.
Activation Key is not accepted. (Evaluation software only.) | Verify that you typed or copied the correct key. Make sure there are no extraneous spaces or characters. If this problem continues, contact WatchGuard Technical Support.
A licensing error appears. | Make sure the machine you are logged on to is correctly licensed. If this problem continues, contact WatchGuard Technical Support.
After you install AppLock/Web and restart your server, the server stops responding, or "hangs." | Check your memory configuration. AppLock/Web requires 128 MB of RAM to protect 5000 or fewer files. AppLock/Web requires 256 MB of RAM to protect 5001 to 15000 files. If this problem continues, contact WatchGuard Technical Support.


Troubleshooting the System Tray Icon

The following information lists possible system tray problems, explains what they mean, and provides tips for resolving problems.

Problem: | Action to take:
The System Tray icon is gray, indicating that the system tray cannot communicate with AppLock/Web. | Restart the server. If this problem continues, contact WatchGuard Technical Support.
When you click View Protections, an error message appears stating that the connection is not available. | Close the AppLock/Web user interface and try again. You must log in with your AppLock/Web password to display the View Protections dialog box.
When you attempt to stop the AppLock/Web system tray icon, an error message appears stating that the AppLock/Web System Tray service could not be stopped. | The AppLock/Web System Tray service is actually stopped and can be restarted.


Troubleshooting Miscellaneous Items

The following information lists possible problems, explains what they mean, and provides tips for resolving problems.

Problem: | Description::
Newly added user accounts can be deleted when AppLock/Web protections are on. | When you add, delete or edit user account information, you must close the Windows User Manager to save your changes before turning protections on. If you turn AppLock/Web protections on while the User Manager is open, AppLock/Web prevents your changes from being saved and your new user accounts are not added.
An error message appears stating: “The AppLock/Web management connection you are using has timed out. Please restart AppLock/Web to continue.” | AppLock/Web times out after 30 minutes of inactivity. You must close AppLock/Web and start it again.
Running Internet Services Manager (mmc.exe) on Windows NT 4.0 while AppLock/Web protections are on can causes mmc.exe to stop responding, or "hang." | You must end the mmc.exe program with Task Manager. To eliminate this problem, upgrade your server to Windows 2000.
A deleted virtual root appears in the list of protected files. | After you delete a virtual root using the Internet Services Manager, AppLock/Web continues to discover and protect Web site files in the deleted virtual root until the IIS server is restarted.


About WatchGuard

WatchGuard is a leading provider of Internet and server security solutions to put your mind at ease. Simple answers to complex problems – dynamic, comprehensive solutions that are effective and easy-to-install and manage, delivering the finest network security available today. We are committed to the creation of scalable, industry-standards-compatible technology that will continue to be the best security value for your investment. WatchGuard is a pioneer in the creation of the plug-and-play Internet security appliance and server security software, offering powerful security solutions for any size organization.

Corporate Headquarters
Address: | WatchGuard Technologies, Inc. 505 Fifth Avenue S. Suite 500 Seattle, WA 98104
Telephone: | 206.521.8340
World Wide Web: | www.watchguard.com
WatchGuard Technical Support: | www.watchguard.com/support


Sales

WatchGuard's professional sales staff is ready to answer your sales questions Monday to Friday from 9:00 A.M. to 6:00 P.M. Eastern Standard Time.

Contact your sales representative for information about the latest WatchGuard products, upgrade options and prices, and more at 1-800-663-1871. If you have a technical question or problem, please contact Technical Support.


Technical Support

At WatchGuard we work hard to provide you with intuitive technical products. Additionally, we provide superior online documentation to enable you to work independently. If you have a technical question that you cannot answer with the provided tools, please contact our Technical Support department.

If you find a problem with AppLock/Web, visit WatchGuard Technical Support from the LiveSecurity Web site, http://www.watchguard.com/support.

When contacting Technical Support...

Please provide the following information for the fastest possible service:

  • License Key

  • Your name, company name, and phone number

  • Exact product name and version number

  • Operating system

  • Complete description of the issue, including steps to reproduce it

  • Exact wording of any messages displayed when you encountered the problem

  • Steps taken to resolve the problem


About Help

About AppLock/Web for IIS Help

WatchGuard® AppLock/Web for IIS™

for Windows NT® and Windows® 2000

HTML Help

Copyright© 2000-2001

June 15, 2001


AppLock/Web Icon

The lock and color indicates the protection state.


Cancel Buttton

Cancel Button

The Cancel button closes this dialog box without saving any changes you have made.


Change Password Button

Your password is important; it stops others from gaining access to your systems. If you have a personnel change or a new administrator, it is advisable to create new passwords. Click Change Password on the Login dialog box to change your password.


Close Button

The Close button closes this dialog box and retains any changes you have made.


Confirm_New_Password

Type the newly created password to confirm it. Do not forget this password.


Files Pane

The Files Pane lists the files within the selected folder from the Folders Pane. The protection status, files in the selected folder, file type, and discovery status is identified.

Protect Column: A check mark in this column indicates that the file is protected, or that AppLock/Web recommends protecting it, if it is a newly discovered file. Click OK and Lock the Server to protect all selected files.

Folder Contents Column: When you select a folder in the Folders Pane, the names of the files in that folder appear in this column.

Type Column: Displays the extension of each file, allowing you to identify the file types.

New Column: A check mark in this column indicates that the file was discovered during the current AppLock/Web session.

Click the column heading to sort the items. The topics are sorted and displayed in ascending order. To display them in descending order, click the column header again.


Folder Contents Column

When you click a folder in the Folders pane, this column displays the files in all of the IIS-related directories.

Click the column heading to sort the items. The topics are sorted and displayed in ascending order. To display them in descending order, click the column header again.


Folders Pane

The Folders Pane displays the directory structure of your Web site files. Click each folder to view its contents.

Web Site Files: Contains all your Web site files discovered by AppLock/Web. Double-click this folder to see the other folders within it.

New Files: Contains new Web site files discovered during the current session of AppLock/Web.

Unprotected Files: Contains Web site files that are not automatically protected by AppLock/Web, including newly discovered unprotected files.

Protected Files: Contains Web site files that are currently protected by AppLock/Web and new Web site files that AppLock/Web recommends protecting. The new files are not protected until you click OK to save the changes and lock the server.


Help Button

Click Help to open online Help.


Help Button

Click Help to open online Help. The file opens to the Restore Defaults topic.


Lock/Unlock Button

Lock the Server/Unlock the Server Button

The name of this button changes according to the protection state of your server.

Click Unlock the Server when you want to turn protections off and make changes to your Web site. When you have finished making changes, click Lock the Server to run AutoDiscovery and secure your files.

If you close AppLock/Web without clicking Lock the Server, your files are not protected and your Web site is vulnerable.


New Column

A flag in this column indicates that the file was discovered during the current AppLock/Web session.

Click the column heading to sort the items. The topics are sorted and displayed in ascending order. To display them in descending order, click the column header again.


New Password

Type a new password. This must be a strong password.


OK Button

The OK button applies and saves any changes you made and then closes this dialog box.


Old Password

Type your original AppLock/Web password.


Protected Column

Protect Column

Contains check boxes that may be selected or cleared. If a check mark appears in this column, the file is protected or AppLock/Web recommends protecting it, if it is a newly discovered file. When you click OK and then Lock the Server, all checked files are protected.

Click the column heading to sort the items. The topics are sorted and displayed in ascending order. To display them in descending order, click the column header again.


Restore Default Protections Button

Restore Defaults Button

Click Restore Defaults to protect typical Web site files as defined by AppLock/Web. Restore Defaults automatically protects all recognized Web site files and unprotects any other files that are not recognized as Web site files.


Type Column

This column displays the file extension and identifies the file type.

Click the column heading to sort the items. The topics are sorted and displayed in ascending order. To display them in descending order, click the column header again.


Log In

Type the AppLock/Web password to log in. The password must be a strong password.


View/Edit Protections

View/Edit Protections Button

Click to view or edit files to protect. You can view current protections, run AutoDiscovery, set file protections, or restore the original protections.


Installing Software That Does Not Requires a Restart

Installing Software That Does Not Require a Restart

  1. Double-click the System Tray icon to open the AppLock/Web dialog box. Alternatively, you can click Programs from the Start menu and choose WatchGuard AppLock Web.

  2. When prompted, type the AppLock/Web password.

  3. At the AppLock/Web dialog box, click Unlock the Server.

  4. Install the new software.

  5. Return to the AppLock/Web dialog box and click Lock the Server. AppLock/Web runs AutoDiscovery, searching all the files within your Web site to find if any files were added or removed. It then updates the list of Web site file protections and locks the server.

  6. Click Close.


Installing Software That Requires a Restart

To install software that requires you to restart your computer:

  1. Double-click the System Tray icon to open the AppLock/Web dialog box.
    Alternatively, click Programs from the Start menu and choose WatchGuard AppLock Web.

  2. When prompted, type the AppLock/Web password.

  3. At the AppLock/Web dialog box, click Unlock the Server.

  4. Close AppLock/Web. AppLock/Web displays a message warning that you are quitting without all protections enabled.

  5. Click Yes to continue, leaving your server unlocked.

  6. Install the new software.

  7. Allow the server to restart and the installation to finish its configuration.

  8. Open AppLock/Web again.

  9. When prompted, type the AppLock/Web password.

  10. Click Lock the Server on the AppLock/Web dialog box.
    AppLock/Web runs AutoDiscovery, searching all the files within your Web site to find if any files were added or removed. It then updates the list of Web site file protections and locks the server.

  11. Click Close.

Important: If you do not lock AppLock/Web within 15 minutes of the restart, it locks automatically. However, you must open AppLock/Web, Unlock the Server, and Lock the Server to run AutoDiscovery to protect the newly added files.


About AppLock/Web

The About dialog box displays information you might need when contacting WatchGuard Technical Support, such as the version numbers of the AppLock/Web components. View Protections displays a list of Web site files and Microsoft IIS application files currently protected by AppLock/Web.


AppLock/Web Recovery Hardware Profile

The AppLock/Web installation creates an AppLock/Web Recovery hardware profile. Starting your server with the AppLock/Web Recovery hardware profile disables AppLock/Web, allowing you to reset your AppLock/Web password. Choose the AppLock/Web Recovery hardware profile from the options displayed during startup.

When you start your computer with the AppLock/Web Recovery hardware profile, a warning appears stating that AppLock/Web is disabled.

Your computer is not secure when started with the AppLock/Web Recovery hardware profile or in Windows 2000® Safe Mode. For absolute security, remove your system from the network while it is unprotected.

Do not leave your computer in the AppLock/Web Recovery hardware profile or in Safe Mode or use either as the default startup option.


IIS Application Protections

The AppLock/Web installation searches for and locks down critical files and registry keys within your Microsoft® IIS application. When AppLock/Web protections are on and your server is locked, these files are protected from unauthorized changes.


Launch LiveSecurity

Launch LiveSecurity accesses AppLock/Web Technical Support (www.watchguard.com/support).


License Key

AppLock/Web requires a License Key for installation. Locate the License Key on the back of the AppLock/Web CD jewel case.


Manage AppLock/Web

Opens the AppLock/Web dialog box. You must log in with your password.


Operating System Protections

The AppLock/Web installation searches for and locks down critical files and registry keys within your Windows operating system. When AppLock/Web protections are on and your server is locked, these files are protected from unauthorized changes.

Operating system and Microsoft IIS applications protections are established only during installation.


Strong Password

The AppLock/Web password is a strong password that requires:

  • A minimum of seven characters

  • A maximum of 14 characters

  • At least one upper case character

  • At least one lower case character

  • At least one number

  • At least one punctuation mark or special character such as !, @, #, and so forth.

  • One number or special character which cannot be a hyphen, in the interior of the password


View Protections

From About AppLock/Web, View Protections displays a list of current Web site file protections, including Microsoft IIS application files currently protected by AppLock/Web.

To see the current protections:

  1. Click View Protections.

  2. Log in with your AppLock/Web password.

If the AppLock/Web is open when you click View Protections, an error message warns that the connection is not available. Close the AppLock/Web user interface and then open the View Protections dialog box.

Copy to Clipboard copies the list of protections to the Clipboard, from which you can paste it into an e-mail for transmission to AppLock/Web technical support, or into a text file for printing.


Web Site File Protections

During installation, AppLock/Web AutoDiscovers Web site content with more than 200 known file extensions and locks it down.

Each time you make changes to your Web site files, click Lock the Server on the ApppLock/Web dialog box to run AutoDiscovery and update the Web site file protections.

The Web site file discovery process does not search for changes to the files and registry keys of the operating system or the Microsoft IIS application.

Use the View/Edit Protections dialog box to see the protection state of your Web site files and make any necessary changes.


Windows 2000 Safe Mode

Safe Mode is a Windows® 2000 boot mode. When you need to reset a new AppLock/Web password on a Windows 2000 server, you must start your server in Safe Mode to disable AppLock/Web. Enter Safe Mode by pressing F8 when you see the message, "For troubleshooting and advanced startup options for Windows 2000, press F8."

Your computer is not secure when started with the AppLock/Web Recovery hardware profile or in Windows 2000 Safe Mode. For absolute security, remove your system from the network before unlocking the server, and relock your server before returning it to the network.

Do not leave your computer in the AppLock/Web Recovery hardware profile or in Safe Mode or use either as the default startup option.