Microsoft identified a security vulnerability in shtml that was locked down by the IIS Lockdown security tool. Here is a link that explains: http://www.derkeiler.com/Mailing-Lists/Securiteam/2001-08/0072.html