Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are running Microsoft Server 2003 with IIS. We would like to give our developers access to manage IIS (through IIS Admin) but do not want them to be administrators of the entire machine.

Putting them in "Power Users" group does not seem to work.

What permissions should we grant to our developers to allow them to manage IIS (e.g. add websites, modify app pools, etc.) without giving them full admin rights to the server?

share|improve this question
up vote 2 down vote accepted

Install the IIS Management Console onto their local machine, and get them to connect to the server from their local machine. Then you can give them whatever permissions they need on the local machine, disable their ability to log on to an interactive session, and then they can't get up to too much mischief.

This is how IIS servers should be administered anyway, it's generally a bad idea to have admins (let alone devs) logging onto server just to change a minor IIS setting.

The Windows 7 version of the Admin tools (which will administer 2k3 IIS just fine using the IIS 6 management console) can be found here.

share|improve this answer
Thanks. Does this mean they still need Administrator rights on the server (even though you disable remote login access)? – Carl Mar 16 '10 at 6:45
Yes, they still need whatever rights assigned locally to get them access to the IIS, but you can add them into your local administrator group to limit the surface area if they do manage to gain access to the server. Note that adding them to the local administrators also gives them access to the administrative shares on the machine (e.g. \\server\c$) - so you might want to look at locking down those shares as well if local admin is required. – Mark Henderson Mar 16 '10 at 7:19

You need to be in the Administrators group to manage IIS in Windows Server 2003. In Windows Server 2008 it is possible using "Feature Delegation" module.

share|improve this answer

I don't think you can give them permission to manage IIS without making them local administrators on windows 2003.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.