I've got an IIS server running a webapp that we use that I have to make 800-171 compliant. As part of that, we use the DISA STIGs as guidelines. On this server, I have applied the Windows Server 2019 STIG, the IIS 10.0 Site Server STIG, and the IIS 10.0 Site STIG.

The site runs fine for the most part but there are a number of icons used on the site that give the broken link image and after inspecting the page, it tells me that they are giving a 500 (internal server error). The site worked fine before applying the IIS STIGS. I can't figure out what setting broke it. The site is ASP based if that helps.

Has anyone else seen this or have any idea what it could be?