up vote 0 down vote favorite
share [g+] share [fb]

I've got IIS 7 running on two Server 2008 machines. One is a Domain Controller.

How do I let my web guy manage IIS -- create applications and virtual directories, modify all settings -- without putting him in the administrators group (local or domain)?

(I know there's a similar question posted here, but the accepted answer was "make him an admin", and that's not an option for me.)

link|improve this question
40% accept rate
6  
Hmmm... running a web site on a DC, that sounds like a bad idea. Have you considered moving the web site to another server? – joeqwerty Nov 24 '10 at 18:13
3  
If you stop referring to Domain Controllers as PDC's and BDC's your problems will all magically disappear :) – Ben Pilbrow Nov 24 '10 at 18:41
I'm with joeqwerty - remove IIS from the DC. IIS is one of Microsoft's most targetted malware platforms. Compromise IIS, and your DC (and therefore domain) is open. – Simon Catlin Nov 24 '10 at 20:06
The IIS installation is only accessible from inside the firewall, so less of a security risk than it seems. I could move IIS to a non-dc fileserver, but still, making the devs admins would give them access to everyone's files, wouldn't it? – Jesse Nov 24 '10 at 20:11
Jesse, if you read the two answers below you'll see that you can delegate iis management permissions separate from standard domain and server permissions. This allows you to do things like run IIS on a DC while still limiting some risk (granted, not ideal, but i don't know what constraints you work within so I wont judge.) – CurtM Nov 25 '10 at 4:46
feedback

2 Answers

up vote 1 down vote accepted

You can delegate control of IIS sites and applications to users, much like you can delegate rights to objects in Active Directory. See the link for instructions. A few more links to help out:

http://learn.iis.net/page.aspx/207/delegated-administration/

http://learn.iis.net/page.aspx/94/delegating-administration/

http://www.trainsignaltraining.com/iis-7-remote-administration-2/2008-06-17/

http://learn.iis.net/page.aspx/155/an-overview-of-feature-delegation-in-iis-70/#03

link|improve this answer
feedback
up vote 0 down vote

I believe IIS management has it's own set of rights with IIS7. Information for delegating IIS administration can be found here.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.