We need to hide the server header in HTTP respones. When I set the urlscan parameter, Removeserverheader to 1, the server header is not present in an HTTP response test. However, when the url for the login page to our site is accesed, a Page Cannot be Found error page displays with HTTP 400 bad request...

Does anyone know if there is a way to have URLSCAN only log what it would block? We'd like to use on a production server, but we don't want to actually block requests until we've tuned the ruleset. We do have a development server, but I can't guarantee testing there would cover 100% of...

I'm using UrlScan 3.0 on IIS 6.0 (IIS 7.0 is not an option). I need to block all requests for URLs which contain "NR" as a path segment: http://localhost/ NR /.... Here's my UrlScan.ini file (most settings are the defaults, changes are in italics, things I think are significant are...