When configuring your IIS 7 (or later) to allow custom extensions or extensionless URLs, you may receive the Lock violation error message (especially if you are running Kentico in a virtual directory).
This may be caused by a locked defaultPath attribute in the httpErrors section. You can check and unlock it in Internet Information Services (IIS) Manager. Select your site (IIS site) and open Configuration Editor (it is included in the Management section in the standard installation of IIS 7.5, if you are using IIS 7, you can download and install it as a part of the IIS7 Administration Pack).
In the Configuration Editor, choose system.webServer/httpErrors in the Section drop-down.
If there is a lock icon next to the defaultPath attribute, right-click the attribute name and select the ‘defaultPath’ Attribute -> Unlock Attribute action. If the option is missing in the menu, you probably need to unlock it on a higher level in the IIS tree, i.e. on the parent site or on the root of the server.
Click Apply to save the changes. From now, the Lock violation errors shouldn’t appear.