1

I have a site that has anonymous access disabled and uses only IIS basic authentication. The site's home directory only has the MACHINENAME\Users group with permissions. I have one user that I don't want to be able to log-in to this site, so I thought all I would need to do is take that user out of the Users group, but doing so still allows him to authenticate. I know it is the Users group that is allowing authentication because if I remove that group's permissions on the directory, he is not allowed to log in.

Is there something special about the Users group that makes it so you are actually always a part of it?

Is the only solution to revoke the Users group's permissions on the site's home directory and grant a new group access that contains only the allowed users?

Improve this question

6 Answers 6

Reset to default
1

How are you limiting the access to just the Users Group? The iis authentication is just authentication, not access control. e.g. if it's an asp.net site, you can set access to individual accounts / groups etc.

Improve this answer
3
  • 1
    The permissions set on the home directory of the site works as access control. If I revoke the Users group's permissions from the home dir, no one can authenticate thru IIS unless I grant that user explicit permissions to the home dir.
    – jayrdub
    Sep 17, 2009 at 15:50
  • So can he authenticate AND still browse that hom dir? If he doesn't have perms then that doesn't make sense.
    – Quinn Wilson
    Sep 18, 2009 at 16:21
  • No, he can't authenticate or browse home dir if I remove Users group. He can if I explicitly add the user or if I add back the Users group.
    – jayrdub
    Sep 21, 2009 at 16:46
0

Normally, removing a user from a group requires the user to log off and back on as group membership is contained in the access token for the user, so a log off and log on is required in order to get a new access token reflecting the new group membership.

I'm not sure how this works with local groups but have the user log off and back on to their workstation and see if it helps. If not, you might try rebooting the server.

Improve this answer
1
  • The user account is set to not allow logon to the server, it is for access to the website only.
    – jayrdub
    Sep 17, 2009 at 15:47
0

Add that user to the site's home directory with an explicit deny?

Improve this answer
0

Remove Users and setup another group with only the users you want.

Improve this answer
0

You need to be compatible with the article KB 812614 for the Web site to work in IIS. Add a particular user in the "Deny log on locally" to deny access for that particular user.

Improve this answer
0

What does the membership of the Users group look like? Do you by chance have authenticated users or domain users in there?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .