0

I've read up on the IIS7 permissions and have a clear understanding of the new user and group. However, what is confusing me is what is happening with the folder permissions.

I have a directory in one of our sites which appears to have inherited IUSR permissions from its parent. Upon inspection, the inherited permissions is coming all the way from drive C. But when reviewing drive C, the ISUR is not there in its permissions, not even in effective permissions.

This is concerning. Why would drive C even have ISUR permissions assigned? We never set them. And: Why is the web folder we are trying to configure telling us its inherited from C? Furthermore, the web folder is very nested, and all of its parent folders don't have the ISUR inherited. Um?

If anyone can shed a light on what is happening that would be appreciated.

Greg.

2 Answers 2

0

Assuming a default installation of IIS, the IUSR account should have permissions on the wwwroot folder, which should be the parent folder from which it is inheriting permissions for all of your web sites, assuming the default root folder for all web sites is wwwroot\websitefolder.

2
  • ... which it shouldn't be. wwwroot is the Default Web Site. You typically don't want your other sites being accessible through Default Web Site/foldername. IIS supports websites in any arbitrary file system location, there's no requirement to have them in Inetpub.
    – TristanK
    Aug 10, 2011 at 11:55
  • All I'm saying is that in the default install of IIS, the default folder for all web sites is wwwroot (C:\Inetpub\wwwroot) and that that's where the permissions are being inherited from.
    – joeqwerty
    Aug 10, 2011 at 12:33
0

Check to see if the IUSR account is the owner of the folder. If it is, the permissions are probably being inherited implicitly from the C: by virtue of the CREATOR OWNER permissions on the C:. When Windows applies CREATOR OWNER permissions, they appear as though they were explicitly defined for the owner.

If you were to change the owner from IUSR to another account or group, these permissions would no longer be inherited for IUSR. However, if IUSR is the owner of the folder it probably means that it was created by the IIS worker process (i.e. the website), so it probably doesn't hurt for it to have those permissions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .