The Server Auto Lock-Down installer does not allow you to apply lock-down for newly created sites without re-installing the lock-down tool from the beginning.

Follow the procedure to re-install the lock-down tool for a new site.

Assumptions

ColdFusion is configured with one site cfsite1, and the runtime user name of ColdFusion after lockdown is cfuser. In addition, you have already locked down the instance cfusion (located as C:\ColdFusion2018\cfusion). The magic folder path for the site is C:\ColdFusion2018\config\wsconfig\1

You have a second site called cfsite2, which you want to lock down without running the Server Auto-Lockdown installer.

For the site cfsite2,

• The webroot is located as C:\inetpub\cfsite2
• The appooolname is cfsite2
• The websitename is cfsite2

Procedure

1. Create a connector for the website cfsite2, which has a magic folder, for example, C:\ColdFusion2018\config\wsconfig\2.
2. Right-click the magic folder and click Security> Advanced.
3. Click Disable Inheritance, and enable the option Remove all inherited permissions from this object. All permissions get removed as shown below:
4. Perform the set of steps below:
   1. Set 1 
      1. 1. Click Add.
         2. Click Select a principal.
         3. Enter the domain of the machine in locations.
         4. Enter <Administrator user name> in Enter the object name to select.
         5. Click OK.
         6. Select Full control for Basic Permissions.
         7. To save the changes, click OK.
   2. Set 2
      1. Click Add.
      2. Click Select a principal.
      3. Enter the Domain of the machine in locations.
      4. Enter Administrators in Enter the object name to select.
      5. Click OK.
      6. Select Full control for Basic Permissions.
      7. To save the changes, click OK.
   3. Set 3
      1. Click Add.
      2. Click Select a principal.
      3. Enter the Domain of the machine in locations.
      4. In the Enter the object name to select field, enter cfuser.
      5. Click OK
      6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
      7. To save the changes, click OK.
   4. Set 4
      1. Click Add.
      2. Click Select a principal.
      3. Enter the Domain of the machine in locations.
      4. In the Enter the object name to select field, enter IIS AppPool\cfsite2.
      5. Click OK
      6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
      7. To save the changes, click OK.
5. Click Replace all child object permissions. Click Apply.
6. Navigate to the webroot and right-click. In Security, click Advanced. Click Disable inheritance and remove all inherited properties. Follow the set of steps below:
   1. Set 1
      1. Click Add.
      2. Click Select a principal.
      3. Enter the domain of the machine in locations.
      4. In Enter the object name to select field, enter IIS AppPool\cfsite2.
      5. Click OK
      6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
      7. To save the changes, click OK.
   2. Set 2
      1. Click Add.
      2. Click Select a principal.
      3. Enter the domain of the machine in locations.
      4. In Enter the object name to select field, enter IUSR.
      5. Click OK
      6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
      7. To save the changes, click OK.
   3. Set 3
      1. Click Add.
      2. Click Select a principal.
      3. Enter the domain of the machine in locations.
      4. In Enter the object name to select field, enter IIS_IUSRS.
      5. Click OK
      6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
      7. To save the changes, click OK.
   4. Set 4
      1. Click Add.
      2. Click Select a principal.
      3. Enter the domain of the machine in locations.
      4. Enter <Administrator user name> in Enter the object name to select.
      5. Click OK.
      6. Select Full control for Basic Permissions.
      7. To save the changes, click OK.
   5. Set 5
      1. Click Add.
      2. Click Select a principal.
      3. Enter the Domain of the machine in locations.
      4. Enter Administrators in Enter the object name to select.
      5. Click OK.
      6. Select Full control for Basic Permissions.
      7. To save the changes, click OK.
   6. Set 6
      1. Click Add.
      2. Click Select a principal.
      3. Enter the Domain of the machine in locations.
      4. In the Enter the object name to select field, enter cfuser.
      5. Click OK
      6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
      7. To save the changes, click OK.
7. Click Replace all child object permissions. Click Apply.
8. Navigate to C:\ColdFusion2018\cfusion\wwwroot. Right-click cf_scripts. Click Security > Advanced. Execute the steps below:
   1. Click Add.
   2. Click Select a principal.
   3. Enter the domain of the machine in locations.
   4. In Enter the object name to select field, enter IIS AppPool\cfsite2.
   5. Click OK
   6. Select Read & Execute, List folder contents, and Write for Basic Permissions.
   7. To save the changes, click OK.
9. Navigate to the magic folder for cfsite1 (C:\ColdFusion2018\config\wsconfig\1) and open the file worker.properties. Copy the value for key worker.cfusion.secret. Navigate to the magic folder for cfsite2 (C:\ColdFusion2018\config\wsconfig\2) and open the file worker.properties. Create a key worker.cfusion.secret=<Value copied above>.
10. Navigate to inetmgr and launch IIS Manager. Copy the Request Filtering settings from cfsite1 to cfsite2 (Click cfsite1 -> Request Filtering -> URL).
11. Navigate to inetmgr and launch IIS Manager. Click the website cfsite2. Remove X-Powered-By header from HTTP Response Header.
12. Restart the ColdFusion instance.
13. Restart the IIS website.

NOTE: After uninstalling Lockdown, you must revert these settings manually.