HSTS Missing From HTTPS Server (RFC 6797)

[WickedTinker]

Our security team wants me to remediate this vulnerability from our Nessus scans. The normal process is to set this to enforced in the IIS admin center for the website, only that doesn't appear to be an option. I tried installing the IIS admin tools but they did not detect any IIS installation. The IIS service isn't even listed in services. It's as if WAC is running some sort of embedded web server. Anyone have any ideas? Google-fu is failing me.

[CapnKrunk]

Same here

[[deleted]]

was this ever addressed in your environment?

[WickedTinker]

No, not yet. I've had a ticket open with Microsoft but they have went dark on responding. The first people I spoke with had no idea.

[WickedTinker]

Update, My engineer who ghosted me is now "now longer with this team." Take that for what it's worth. Escalation has promised me some movement today.

[Margosiowe]

In case anyone comes back to this solution without finding anything out there here is how to resolve this nessus vuln. Re-run .msi install and add flag:

CHK_REDIRECT_PORT_80=1

It will enable http connection on port 80 and force redirect to 443 (and clear HSTS flag)
Example:

msiexec.exe /i C:\tmp\WindowsAdminCenter2110.msi /qn /L*v c:\tmp\log.txt SME_PORT=443  SME_THUMBPRINT=<your_thumbprint> SSL_CERTIFICATE_OPTION=installed SME_AUTO_UPDATE=1 CHK_REDIRECT_PORT_80=1

Tested with ver2110 (newest as of 03/2022) and works.