Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got IIS 7 running on two Server 2008 machines. One is a Domain Controller.

How do I let my web guy manage IIS -- create applications and virtual directories, modify all settings -- without putting him in the administrators group (local or domain)?

(I know there's a similar question posted here, but the accepted answer was "make him an admin", and that's not an option for me.)

share|improve this question
7  
Hmmm... running a web site on a DC, that sounds like a bad idea. Have you considered moving the web site to another server? –  joeqwerty Nov 24 '10 at 18:13
3  
If you stop referring to Domain Controllers as PDC's and BDC's your problems will all magically disappear :) –  Ben Pilbrow Nov 24 '10 at 18:41
    
I'm with joeqwerty - remove IIS from the DC. IIS is one of Microsoft's most targetted malware platforms. Compromise IIS, and your DC (and therefore domain) is open. –  Simon Catlin Nov 24 '10 at 20:06
    
The IIS installation is only accessible from inside the firewall, so less of a security risk than it seems. I could move IIS to a non-dc fileserver, but still, making the devs admins would give them access to everyone's files, wouldn't it? –  Jesse Nov 24 '10 at 20:11
    
Jesse, if you read the two answers below you'll see that you can delegate iis management permissions separate from standard domain and server permissions. This allows you to do things like run IIS on a DC while still limiting some risk (granted, not ideal, but i don't know what constraints you work within so I wont judge.) –  CurtM Nov 25 '10 at 4:46

3 Answers 3

up vote 3 down vote accepted

You can delegate control of IIS sites and applications to users, much like you can delegate rights to objects in Active Directory. See the link for instructions. A few more links to help out:

http://learn.iis.net/page.aspx/207/delegated-administration/

http://learn.iis.net/page.aspx/94/delegating-administration/

http://www.trainsignaltraining.com/iis-7-remote-administration-2/2008-06-17/

http://learn.iis.net/page.aspx/155/an-overview-of-feature-delegation-in-iis-70/#03

share|improve this answer

I had a similar problem and neither "make him an admin" or using Feature delegation (kept getting an error about a missing configuration section 'wsgi' were working for me.

This is what you do:

  1. Install the IIS Management Service (using Server Manager)

  2. Open IIS Manager

  3. Select the Site you want to grant access to and select the "IIS Manager Permissions" feature. From there, I add the user to the list using the "Allow User..." option.

  4. From the Server Features View, select the "Management Service" feature and make sure the service is running.

Your non-admin user should be able to access the specific website settings from the IIS Manager with his account. Unlike administrators, he won't see the available sites by default the first time around. He will have to establish a new connection to a website by specifying the server (localhost) and the website (as specified in IIS, NOT the actual public URL).

Once the connection is established and saved, it will only ask for the account password the next time you run IIS Manager.

Hope this helps anybody with a similar issue, I had to dig a bit myself to find this solution.

share|improve this answer

I believe IIS management has it's own set of rights with IIS7. Information for delegating IIS administration can be found here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.