Error: The Web Server Has Been Locked Down and Is Blocking the DEBUG Verb
Applies to: 
Visual Studio 
Visual Studio for Mac
Note
This article applies to Visual Studio 2017. If you're looking for the latest Visual Studio documentation, see Visual Studio documentation. We recommend upgrading to the latest version of Visual Studio. Download it here
Stepping into a Web application or XML Web service failed because the IIS lockdown tool has been run and URLScan has been installed and activated. This condition blocks IIS from receiving the DEBUG verb.
URLScan is a security tool that works in conjunction with the IIS Lockdown Tool to give IIS Web site administrators the ability to turn off unnecessary features and restrict the type of HTTP requests that the server will process. By blocking specific HTTP requests, the URLScan security tool prevents potentially harmful requests from reaching the server and causing damage.
If your application is running on IIS 6.0 on Windows Server 2003, you need not run the IIS Lockdown tool because IIS 6.0 provides the same functionality.
To enable debugging on a Web server with URLScan installed
Locate the Urlscan.ini file. Normally, you will find it in a directory that looks something like this:
C:\WINNT\System32\Inetsrv\urlscan
Create a copy of the file, and name it Urlscan.old.
Open the original copy of the Urlscan.ini file using Notepad or the text editor of your choice.
In Urlscan.ini, locate the [AllowVerbs] section. Add DEBUG to the [AllowVerbs] section. If you see ;DEBUG in the [AllowVerbs] section, remove the semicolon to uncomment the verb.
Locate the [DenyVerbs] section. If DEBUG appears in the [DenyVerbs] section, remove it.
Save the file.
Restart the server or restart IIS.