4

From IIS I need to access a folder on another computer. Both servers are Window 2008 SP2, and they live in a Virtual Private Cloud on Amazon EC2. They reach one another by private IP -- they are in WORKGROUP, not a domain.

I can access the shared folder manually when logged in to the client as Administrator. But IIS gets "access denied." Here's what I have done:

  1. Set File Sharing = ON
  2. Set Password Protected Sharing = OFF
  3. Set Public Folder Sharing = ON
  4. Shared the folder
  5. Added permission to the share: Everyone, Full Control
  6. Added permission to the share: NETWORK SERVICE, Full Control
  7. Verified that File & Printer Sharing is checked in Windows Firewall
  8. Opened port 445 to inbound traffic from local sources

I tried adding <remote-machine-name>\NETWORK SERVICE to the share but it says it does not recognize the machine, which makes sense, I guess.

As I said, from the other computer I have no trouble accessing the shared folder from my user account, but IIS is shut out. How does the file server even know the difference? I would assume that with Everyone given full control and password protected sharing turned off, it would not matter what the client user account is.

In any case, how to solve?

UPDATE: To clarify, I am not trying to serve up files on the share directly through IIS. Rather I am writing files to the share from my code (System.IO).

Improve this question

1 Answer 1

Reset to default
4

IIS's default operational mode is quite locked down. IIS doesn't use <computername>\NETWORK SERVICE. It uses <computername>\IUSR_<computername>, which is a member of the <computername>\Guests group. If the web page you're trying to access on the IIS server instead is requesting authentication, it will instead attempt to use those credentials to authenticate. If the files it's accessing are executable scripts, then instead it uses IWAM_<computername>. I don't remember offhand the group membership of that.

What you want to do here isn't very easy to configure over a workgroup. You'd have to set up an account on the remote machine with the same username and password that the IIS system is using. You can use a script to hopefully determine the IIS user account's password, but I don't know if IIS changes that periodically or if the script doesn't function on newer versions.

Improve this answer
3
  • Not sure if it matters, but I might clarify that I am not trying to access some file on the share through IIS as a URL. I am using System.IO to write to files in the folder. Basically it's a upload page that wants to save the stream to a share.
    – Tim Scott
    Apr 24, 2011 at 23:42
  • Ah, that does change things. I avoid the NETWORK SERVICE account in lieu of creating a dedicated service account on both machines. NETWORK SERVICE had so many random security issues and special case lock downs that I would only ever use it on legacy systems which demanded it. Is as close to deprecated as possible.
    – Bacon Bits
    Apr 25, 2011 at 1:48
  • I created a new account on the web server and set my App Pool to run under it. Problem solved it seems. I did not create a parallel account on the app server machine (where the share is). But here's what I'm still unsure about. I've not used Server 2008, so the account management is strange to me. My only choices for this new account were "Administrator" and "Standard User" -- no ability to tailor permissions. Is that okay to run a website under a "Standard User" account? If not, how do I customize the account?
    – Tim Scott
    Apr 25, 2011 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .