SOLVED IBCM IIS Security

[Arturus]

Does anyone know of a resource/guide that will help me increase security in IIS for an IBCM without adversely affecting the functionality of MECM?

 

[Youssef Saad]

Hi @Arturus,

It's recommended to use a web proxy server with SSL bridging to SSL to get more secure infrastructure, you can find more details in the following documentation:

• Plan for internet-based client management in Configuration Manager

 

[Arturus]

Hi @Youssef,

Thank you for the response. I was aware of that recommendation but unfortunately our client is against use of a proxy server so I was tasked with attempting manual hardening of IIS on the IBCM. I was just hoping that someone had encountered a similar scenario and would be able to at least confirm it was an achievable task but after fighting with it for several days it looks like I may be going back to them with bad news... this is the exact type of thing that has led me to always make sure to tell anyone thinking of implementing Microsoft's Configuration Manager products that they need to try and stay as close to the Microsoft recommendations as is possible.

 

[Youssef Saad]

IBCM is the basic way to manage the remote devices and above are only the available recommendation from MS, maybe you can suggest to your customer to plan for the Cloud Management Gateway (or any other solution), it's more secure and easily to implement.

 

[Arturus]

It seems pretty clear from their documentation that MS favors the use of a CMG for internet clients. Unfortunately the client is not ready for Azure integration yet so we are moving forward with use of a proxy server, so now I get to learn and implement that configuration. Can you recommend any documentation that would make that effort easier?

 

[Youssef Saad]

You have the choice between using a CMG or the basic option IBCM. Please find below some useful documentation:

• Plan for internet-based client management in Configuration Manager

 

[Arturus]

Thanks @Youssef.
I actually used the guide for the install of the IBCM and they have been one of my go to resources, along with this site, for years. I have also been referencing that MS link as well.
Actually, I should have asked my question in a different way because just I want to have a better understanding of how the web proxy server is set up. I am not the person that will be responsible for actually setting up the web proxy server but having never used one previously, I will be doing some research to get more understanding of how that piece is set up and configured just so I know all of the pieces. Unfortunately the MECM documentation from MS does not go into much detail, and after 13 years of worming with MS Configuration Manager this is my first IBCM. Thank you for all your help.

 

[Youssef Saad]

Maybe if you ask the network security team will provide you more details about this point.
Otherwise, you can always raise a ticket with MS support to get further details. Good luck.