Configure Shadow Copy Storage Server on IIS with HTTPS

SecureSync service can use a WebDav server hosted on Microsoft IIS to securely store Shadow Copy files. This section describes how to configure the Shadow Copy Storage server with HTTPS authentication.

Prerequisites

Ensure that the following requirements are met before configuring the WebDAV server:

• Operating system: Windows 10, Windows Server 2016, or later.
• Administrator privileges on the Windows server.
• A static IP address or hostname for the WebDAV server.
• Port 443 (HTTPS) and 8443 (HTTPS) available for WebDAV communication.

Note:

• If a hostname is used to access the Shadow Copy Storage server, use the same hostname when configuring the HTTPS certificate and IIS binding.
• Add host entry on EPP server machine in /etc/hosts – IPAddress hostname

1. Create the WebDAV user

   1. Open Command Prompt as Administrator.

   2. Run the following command:

      net user Webdavuser <StrongPassword> /add 
      

   3. Run the following command to verify that the user was created:

      net user
      

   4. Confirm that Webdavuser is listed.

2. Create the WebDAV folder

   1. Create the following folder on the server:
      C:\SecureSyncWebDAVRoot\sqepsng80
   2. Verify that the above folder is created successfully.

3. Provide folder permissions

   1. Right-click the following folder:
      C:\SecureSyncWebDAVRoot

   2. Select:
      Properties → Security → Edit → Add

   3. Add the following user:
      Webdavuser

   4. Provide the following permissions:

      • Read
      • Write
      • Modify
      • Read & Execute

   5. Click Apply then click OK and click OK.

4. Install IIS and WebDAV [For Desktop operating system]

   1. Open Control Panel.

   2. Go to:
      Programs → Turn Windows features on or off

   3. Enable and expand Internet Information Services.

   4. Under Web Management Tools, enable:

      • IIS Management Console

   5. Under World Wide Web Services → Common HTTP Features, enable:

      • Default Document
      • Directory Browsing
      • HTTP Errors
      • Static Content
      • WebDAV Publishing

   6. Under World Wide Web Services → Security, enable:

      • Basic Authentication
      • Request Filtering

   7. Click OK and wait for the installation to complete.

5. Install IIS and WebDAV [For Server operating system]

   1. Open Server manager.
      Click on add roles and features > Click on Next > Next > Next
      Select web server (IIS) > Click on add features > Next > Next > Next

   2. Under Common HTTP Features, enable:

      • Default Document
      • Directory Browsing
      • HTTP Errors
      • Static Content
      • WebDAV Publishing

   3. Under → Security, enable:

      • Basic Authentication
      • Request Filtering

   4. Click Next > Install and wait for the installation to complete > click on close.

5. Create the HTTPS certificate

   1. Open PowerShell as Administrator.
   2. Run the following command:

   New-SelfSignedCertificate -CertStoreLocation "Cert:\LocalMachine\My" -Subject "CN=<ServerIPAddress>" -DnsName "<ServerIPAddress>" -FriendlyName "webdavsecuresync" -Type SSLServerAuthentication -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 -KeyExportPolicy Exportable
   

   Note: Replace with the actual IP address or hostname of the WebDAV server. If a hostname is used during server configuration, use the same hostname in the certificate CN and DnsName fields.

6. Verify the HTTPS certificate

   1. Open PowerShell.

   2. Run the following command:

      Get-ChildItem Cert:\LocalMachine\My |
      Where-Object {$_.FriendlyName -eq "webdavsecuresync"} |
      Select Subject,Thumbprint,DnsNameList,EnhancedKeyUsageList,FriendlyName
      

   3. Verify the following:

      • Subject contains the server IP address.
      • DNS Name contains the server IP address.
      • Enhanced Key Usage contains Server Authentication.
      • Friendly Name is webdavsecuresync.

7. Create the IIS website

   1. Open IIS Manager → double click on available connection

   2. Go to:
      Sites → Add Website

   3. Enter the following:

      • Site Name: SecureSyncWebDAV
      • Physical Path: C:\SecureSyncWebDAVRoot

   4. Configure the HTTPS binding as follows:

      • Type: HTTPS
      • IP Address:
      • Port: 443
      • SSL Certificate: webdavsecuresync

   5. Click OK.

   6. Confirm that the SecureSyncWebDAV website status is Started.

8. Configure authentication

   1. In IIS Manager, select:
      SecureSyncWebDAV → Authentication
   2. Disable Anonymous Authentication.
   3. Enable Basic Authentication.

9. Configure WebDAV Authoring Rules

   1. In IIS Manager, select:
      SecureSyncWebDAV → WebDAV Authoring Rules

   2. If WebDAV is disabled, click Enable WebDAV.

   3. Click Add Authoring Rule.

   4. Add the following user:
      Webdavuser

   5. Allow the following permissions:

      • Read
      • Write
      • Source

   6. Click OK to save the authoring rule.

10. Add the .enc MIME type

    1. In IIS Manager, select:
       SecureSyncWebDAV → MIME Types

    2. Click Add.

    3. Enter the following:

       • File name extension: enc
       • MIME type: application/octet-stream

    4. Click OK.

11. Configure the maximum file size

    1. In IIS Manager, select:
       SecureSyncWebDAV → Request Filtering
    2. Click Edit Feature Settings.
    3. Set Maximum allowed content length to:
       62914560
    4. Click OK.
    5. This setting allows files up to approximately 60 MB.

12. Allow HTTPS through Windows Firewall

    1. Open Windows Defender Firewall with Advanced Security.

    2. Go to:
       Inbound Rules → New Rule

    3. Select Port and click Next.

    4. Select:

       • TCP

    5. Enter the following under Specific local ports:
       443

    6. Click Next.

    7. Select Allow the connection.

    8. Click Next.

    9. Select the required network profiles.

    10. Enter the following rule name:
        SecureSync WebDAV HTTPS (TCP 443)

    11. Click Finish.

13. Restart IIS

    1. Open Command Prompt as Administrator.

    2. Run the following command:

       iisreset
       

    3. Wait until IIS restarts successful

14. Test the WebDAV connection

    1. Open Command Prompt.

    2. Run the following command:

       curl.exe -vk -u Webdavuser:<StrongPassword> -X OPTIONS "https://<ServerIPAddress>/"
       

       Verify that the response contains:
       HTTP/1.1 200 OK

15. If the connection fails, verify the following:

    • IIS website status
    • HTTPS certificate
    • WebDAV configuration
    • Webdavuser permissions
    • Windows Firewall settings

Configuring the Shadow Copy Storage Server from the EPP Console

To configure the Shadow Copy Storage Server:

1. Go to Configurations > Shadow Copy Storage Server.
2. Specify the required configuration details.
3. Click Test Connection to verify connectivity with the Shadow Copy Storage Server.
4. After the connection is verified successfully, click Apply to save the configuration.

Note: Ensure that the Shadow Copy Storage Server is configured successfully before enabling Shadow Copy in a DLP policy.

Field Description

Note:

• The Shadow Copy Storage Server configuration is required for the Shadow Copy feature to function correctly.
• Files uploaded to the Shadow Copy Storage Server are encrypted using the configured File Encryption Key.
• If the Shadow Copy Storage Server is unavailable, the endpoint temporarily stores files in the configured Cache File Store Location and retries the upload based on the configured retry interval.
• Shadow Copy feature is applicable only for Windows endpoints.