10 Steps to Secure FrontPage Server Extensions

Open regedit.exe, search the registry for all instances of the old path, and replace them with the new location. Next, download and install MetaEdit 2.2 from the Microsoft Download Center at http://www.microsoft.com/downloads. Use MetaEdit to again search for all instances of the old path and replace them with the new location. Reboot the computer.

To test your changes, create a new FrontPage Web. The server extensions create a _vti_bin directory that points to the new FrontPage Server Extensions location. Remember that after you apply service packs and hotfixes, you must again move these binary files to the new location.

Of course, sometimes you'll simply want to remove FrontPage Server Extensions from your Web sites. To do so, you must first open ISM, right-click each FrontPage Web site, select All Tasks, then select Remove Server Extensions. Next, remove any _vti and _private directories from all Web sites. Finally, edit the master WWW Service properties by right-clicking the computer name in ISM, selecting Properties from the resulting menu, and clicking Edit for the Master WWW Properties. Go to the ISAPI Filters tab, select fpexedll.dll, and click Remove. Close all windows, and FrontPage Server Extensions are now completely disabled for the sites. Note that this process doesn't completely remove FrontPage Server Extensions from your system, so an administrator can reinstall them later.

Remove the Risks
You don't have to remove FrontPage Server Extensions to be secure. Although FrontPage Server Extensions aren't perfect, they aren't inherently unsecure. Although any FrontPage Server Extensions functionality increases a Web server's attack surface, you can greatly reduce your exposure to attack by following the 10 steps to secure FrontPage Server Extensions.