Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a Windows Server 2003 setup to serve multiple sites via IIS. One of our directories needs to allow access to only 1 specific AD Security Group.

I know there are two ways to accomplish this. One is using IIS to add permissions and the other is to set permissions on the folder/directory itself. A script runs at night and populates the content so users only need read permissions to view it in a browser.

My question is which one is preferred?

share|improve this question

migrated from Dec 29 '10 at 15:16

This question came from our site for pro webmasters.

up vote 1 down vote accepted

I would do both. Turn off the anonymous user for the IIS website, and also lock down NTFS permissions to just the AD group + administrators + SYSTEM + the app pool user.

btw, the right-click permissions in IIS on the site level is the same NTFS permissions as if you do it from Windows Explorer directly. It's just a shortcut to the same folder/file security settings.

share|improve this answer
Thanks for the help Scott. – Jan 29 '11 at 18:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.