Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been told by the company's solution architect, that integrated windows authentication or basic authentication cannot be enabled in IIS for our development test or test sites. As such they are actively available as "live" sites over the public internet to the public.

The reason being: is that the company's contract flash developer would not be able to upload or "test" the flash components and that other third party contractors again would not be able to gain access.

I was under the impression what a third party would use FTP to upload and then authenticate in a browser to view what they've done.

The subdomains are hosted via a third party managed server, but the solution architect is the administrator/super users of the win 2008 boxes.

What would be a good start for assessing and analysing the security of IIS disallowing unauthorised access but allowing third party developers to do their jobs.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.