In IIS 7.5 I have blocked the OPTIONS and PROPFIND verbs for a web site. I did this through the GUI. They are set to allowed = FALSE.
However, IIS is not blocking these verbs. Looking at the logs, I see requests with these verbs and IIS is returning a 200 status code.
I don't know what to check. It's a very simple configuration change and I can't find anything on the web about this feature not working. No idea how to troubleshoot this.
Am I missing something obvious?