Windows Server 2016 / IIS Cannot Disable for site

[jdornan]

I have installed version 2.9.3 using the ModSecurityIIS_2.9.3-64b.msi. My web server has multiple sites configured in IIS. ModSecurity is working but I'm unable to disable it for a specific site in the sites web.config file. I have tried adding the items below to the system.webServer section but neither seems to disable ModSecurity.

remove name="ModSecurityIIS"

ModSecurity enabled="false"

[mguinness]

I think the README is a little misleading, all you should need is below (tested as working).

<system.webServer>
  <ModSecurity enabled="false" />
</system.webServer>

Also see #769 (comment) to allow a site to override the global config and have it's own.