Sign up ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

The service.cnf file found in the _vti_pvt directory has the default permission settings which may lead to an unauthorized access to the file What are the steps to deny anonymous access to _vti_pvt directory iis7.

share|improve this question

1 Answer 1

Not having yet identified the full ramifications of this but also not finding official word on the correct approach, I hesitate in recommending this. However, I addressed this vulnerability by disabling inheritance of the security privileges on the _vti_bin directory and removing the Everyone user object, which had Read privileges inherited from the root site directory.

I am using SharePoint Server 2013 SP1 and tested basic functionality in SharePoint Designer 2013 as well as access to the site through the browser (navigating and editing web part content), including uploading and editing files; no issues so far. Even the farm admin doesn't have access to the _vti_pvt directory through a web browser.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.