Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure an IIS 7.5 server to allow remote deployment by a domain user account.

I can achieve this if I create either a local account with Administrator privileges, or use a domain account with Administrator privileges, but for a regular domain account I can't figure out what I need to set.

The steps I've taken so far are:

  • Create user account 'webdeploy' on domain controller
  • Under 'IIS Manager Permissions' for the Default Web Site, I've gone through the 'Allow User...' wizard to allow the domain user access to the site.
  • At the server level, under 'Management Service', I've enabled remote connections for Windows credentials only from all IP addresses.
  • Under 'Management Service Delegation' I've created two rules, 'createApp' and 'contentPath, iisApp' and added the 'DOMAIN\webdeploy' user to each of these.

However, when trying to run msdeploy with the webdeploy account credentials, I receive a '401 Unauthorized' message, and see the following in the eventlog:

IISWMSVC_AUTHORIZATION_SERVER_NOT_ALLOWED

Only Windows Administrators are allowed to connect using a server connection. Other users should use the 'Connect To Site or Application' task to be able to connect.

Process:WMSvc
User=DOMAIN\webdeploy

Does this imply that my buildserver needs to store the credentials of a domain administrator in order to simply push web apps to the web server?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You need to specify the full Web Management Service url with a site parameter. For example, if you were previously using:

msdeploy ... -dest:auto,wmsvc=target

Then you would use this instead:

msdeploy ... -dest:auto,wmsvc=https://target:8172/msdeploy.axd?site=yourSiteName
share|improve this answer

Please Add user in local Administrator group in Machine where you want to deploy App using WebDeployment.

share|improve this answer
    
That appears to have worked for now. It'd be good to get a way of doing this without having to grant full admin rights for the deploy user though. –  growse Mar 10 '11 at 11:20
    
Did you figure out how to do it without full admin rights? –  Tomas Jansson Oct 13 '11 at 8:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.