Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my server, the IUSR_MYSERVER account has write access to some directories. I know this because if you check effective permissions, it says it can "Create Files / Write Data" and "Create Folders / Append Data". The trouble is, if I go look at permissions that are defined, the IUSR_MYSERVER account only had Read & Execute permissions, and nothing more.

This account isn't a member of any groups. What are some things I can check to determine how this account has access to write to files?

Edit: Here is a list of permissions defined for the directory:

Allow   Domain Users (MYDOMAIN\Domain Users)    Read & Execute
Allow   CMS Account (Specific account from our CMS that uploads content)    Modify
Allow   Internet Guest Account (MYSERVER\IUSER_MYSERVER)    Read & Execute
Allow   Launch IIS Process Account (MYSERVER\IWAM_MYSERVER) Read & Execute
Allow   Web Group (MYDOMAIN\Web Group) (This is a group of users who work on the website)   Modify
Allow   Administrators (MYSERVER\Administrators)    Full Control
Allow   CREATOR OWNER   Full Control
Allow   SYSTEM  Full Control
Allow   Users (MYSERVER\Users)  Special (Allowed: Traverse Folder / Execute File, List Folder / Read Data, Read Attributes, Read Extended Attributes, Create Files / Write Data, Create Folders / Append Data, Read Permissions  Denied:  None)
Allow   users (MYSERVER\Users)  Read & Execute
share|improve this question
up vote 3 down vote accepted

An account doesn't necessarily have to be a member of groups to pick up permissions that aren't specifically defined; the Authenticated Users and Pre-Windows 2000 Compatible Access groups are a couple common examples.

If you can post the permissions list for the directory, stripping out any private info, that may help to find the source.

share|improve this answer
I have edited my post with a list of permissions. I don't see anything that could be the source of trouble. Would you mind taking a look? – Brad Mar 25 '11 at 16:10
@Brad By default, Authenticated Users is a member of Users. That's likely granting the rights in question. – Shane Madden Mar 25 '11 at 16:30
Thanks Shane, turns out that IUSR was in user. – Brad Mar 25 '11 at 16:37

Accounts are always members of some groups. In windows these are referred to as implicit groups or identities. Some examples of this are everyone, self ,interactive, authenticated users. For 2003 the list of what they are and what they contain can be found here, for 2008 and above the list can be found here

share|improve this answer
Thanks for those links, that is most helpful. However, none of these implicit groups seem to apply here. I have posted a list of permissions for the folder in question. Would you mind taking a look? – Brad Mar 25 '11 at 16:10

The account is in "Users", which has the rights you say you're confused by.

share|improve this answer
Yep, turns out that was it! Thanks. – Brad Mar 25 '11 at 16:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.