3

I've got IIS 7 running on two Server 2008 machines. One is a Domain Controller.

How do I let my web guy manage IIS -- create applications and virtual directories, modify all settings -- without putting him in the administrators group (local or domain)?

(I know there's a similar question posted here, but the accepted answer was "make him an admin", and that's not an option for me.)

5
  • 7
    Hmmm... running a web site on a DC, that sounds like a bad idea. Have you considered moving the web site to another server?
    – joeqwerty
    Nov 24, 2010 at 18:13
  • 3
    If you stop referring to Domain Controllers as PDC's and BDC's your problems will all magically disappear :) Nov 24, 2010 at 18:41
  • I'm with joeqwerty - remove IIS from the DC. IIS is one of Microsoft's most targetted malware platforms. Compromise IIS, and your DC (and therefore domain) is open. Nov 24, 2010 at 20:06
  • The IIS installation is only accessible from inside the firewall, so less of a security risk than it seems. I could move IIS to a non-dc fileserver, but still, making the devs admins would give them access to everyone's files, wouldn't it?
    – Jesse
    Nov 24, 2010 at 20:11
  • Jesse, if you read the two answers below you'll see that you can delegate iis management permissions separate from standard domain and server permissions. This allows you to do things like run IIS on a DC while still limiting some risk (granted, not ideal, but i don't know what constraints you work within so I wont judge.)
    – CurtM
    Nov 25, 2010 at 4:46

3 Answers 3

3

You can delegate control of IIS sites and applications to users, much like you can delegate rights to objects in Active Directory. See the link for instructions. A few more links to help out:

http://learn.iis.net/page.aspx/207/delegated-administration/

http://learn.iis.net/page.aspx/94/delegating-administration/

http://www.trainsignaltraining.com/iis-7-remote-administration-2/2008-06-17/

http://learn.iis.net/page.aspx/155/an-overview-of-feature-delegation-in-iis-70/#03

2

I had a similar problem and neither "make him an admin" or using Feature delegation (kept getting an error about a missing configuration section 'wsgi' were working for me.

This is what you do:

  1. Install the IIS Management Service (using Server Manager)

  2. Open IIS Manager

  3. Select the Site you want to grant access to and select the "IIS Manager Permissions" feature. From there, I add the user to the list using the "Allow User..." option.

  4. From the Server Features View, select the "Management Service" feature and make sure the service is running.

Your non-admin user should be able to access the specific website settings from the IIS Manager with his account. Unlike administrators, he won't see the available sites by default the first time around. He will have to establish a new connection to a website by specifying the server (localhost) and the website (as specified in IIS, NOT the actual public URL).

Once the connection is established and saved, it will only ask for the account password the next time you run IIS Manager.

Hope this helps anybody with a similar issue, I had to dig a bit myself to find this solution.

0

I believe IIS management has it's own set of rights with IIS7. Information for delegating IIS administration can be found here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .