OK. We are in business. I think I only have one more question related to the CF 10 lockdown. The documentation next talks of blocking unneeded file types. I have been looking on MS Server 2008-R2 IIS for a way to simply block them without removing them. I was looking at the MIME Types and Handlers areas, but these do not seem to be the right tools for this task. Am I approaching this the wrong way? (The lockdown guide sometimes glides over details and uses inconsistent terminology.) I am glad you guys know what you are doing. Thanks.
P.S.: The guide implies that the CFIDE virtual directory should be removed from the lockdown admin site. But if you do that the CF admin doesn't work -- none of the graphics show up. So I put it back. I don't understand how the lockdown admin site can work if CFIDE is removed as a virtual directory.