UrlScan and ASP.NET debugging
I like Microsoft Baseline Security Analyzer and all the suggestions that it gives to improve the security of the scanned PC.
One of the most important suggestion, for me, is to run the IIS Lockdown tool on every Pc with IIS installed.
I always do it, and I don't care if it's a production, a staging or a development server.
But for staging and development servers there is an issue. The IIS Lockdown tool installs the URLScan ISAPI filter to block malformed URLs, bad file extensions and wrong HTTP commands.
The only allowed HTTP commands in the default configuration are GET, POST and HEAD.
To allow VS.NET to debug ASP.NET pages you have to find URLSCAN.INI and edit it to add the DEBUG command to the list of the allowed commands.
If you don't enable it VS.NET tells you to enable server side debugging, but doesn't give you any other hint.
But for your security, don't enable DEBUG on production servers...