Web-based applications sometimes inadvertently expose a site's directory structure. Although the exposed directories do not list their contents, the exposed directory information is detrimental to the site's overall security. By knowing a directory’s name, a potential hacker can guess its content and possible file names that are in it. Sensitive content can pose a severe security threat when directory names are exposed.

To avoid this potential security risk, you can issue 404 - Not Found response status codes instead of 403 - Forbidden response status codes. This change obfuscates the presence of directories on the site, and prevents the site structure from being exposed.

You must be a member of the Administrators group on the local computer to perform the following procedure, or you must be delegated the appropriate authority. As a security best practice, logon to your computer using an account that is not in the Administrators group, and then use the Windows Run as command to run the Internet Information Services Manager as an administrator.