How to Enable Directory Browsing in IIS

IIS directory browsing displays a folder’s contents when no default page is served. You can enable it for a selected downloads folder using IIS Manager or an administrative command.

What is directory browsing in IIS?

A directory listing shows file and folder names, with optional dates and sizes. When browsing is disabled and no default document exists, IIS may return a 403.14 error instead.

Why enable directory browsing?

Use it when visitors need to choose from files intended for download. Check every file in the folder before making the listing public.

Prerequisites

You need permission to configure IIS, the Directory Browsing feature installed, and the exact site and folder name. The examples use the IIS site ExampleSite and its downloads folder; replace both with your own values.

Method 1: Enable directory browsing using IIS Manager

1. Open IIS Manager.
2. Select the required site and folder in Connections.
3. Open Directory Browsing in Features View.
4. Click Enable in Actions.
5. Choose the details to display and click Apply if you change them.
6. Visit the folder’s URL and check the listing.

Select Disable in the same interface when the listing is no longer needed.

Method 2: Enable directory browsing via command line

Use one of these methods for the chosen folder.

AppCmd

In an administrative Command Prompt:

%windir%\system32\inetsrv\appcmd.exe set config "ExampleSite/downloads" /section:system.webServer/directoryBrowse /enabled:true

To disable it:

%windir%\system32\inetsrv\appcmd.exe set config "ExampleSite/downloads" /section:system.webServer/directoryBrowse /enabled:false

Windows PowerShell

In administrative Windows PowerShell with the WebAdministration module:

Import-Module WebAdministration
Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Location 'ExampleSite/downloads' -Filter 'system.webServer/directoryBrowse' -Name enabled -Value $true

Use $false instead of $true to disable it. Check the folder in a browser after the change.

Security considerations

Enable browsing only where it is needed. Keep configuration files, backups and private records outside publicly accessible folders. Disabling a listing does not prevent someone accessing an otherwise accessible file by its URL.