For those of you getting these types of errors when moving ASP code from Win2k to Win2k3.

#########
Active Server Pages error 'ASP 0131'
Disallowed Parent Path
/folder1/folder2/default.asp, line 3
The Included file '../test.asp' cannot contain '..' to indicate the parent
#########

I found this on a newsgroup posting, it worked for me and thought it might be helpful here to someone else.

*****************************
IIS 6 is locked down by default. Parent Paths is a way for a hacker to
navigate to a folder on the web server that has execute permissions, and in
that way execute scripts that you normally shouldn't and wouldn't execute.
If you enable this, make sure that you do not give execute permissions to a
parent folder. To enable Parent Paths, follow these steps:

a.. Click Start->Programs->Administrative Tools->Internet Information
Services
b.. Expand Web Sites and right click the web site you want to enable this
for (i.e Default Web Site), click Properties
c.. Click the Home directory tab and click the Configuration button
d.. Click on the Options tab
e.. Check the box Enable Parent Paths
**********************************

This was very helpful, thanks. One of my users is requesting this and i wasnt sure how to do it. Now if i enable this how do i NOT give execute access?

the general idea of parent-paths is for execute permissions.

I think in IIS you can specify execute or "script" access. So only script type things like ASP, PHP will execute but not batch files and exe etc..

I am pretty sure you can do this on the Home Directory tab.