Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web application which I need to grant permissions to a file share that's hosted on another machine in my DMZ. Users are accessing the application anonymously using the IUSR_Machine account which appears to be the standard configuration. The application needs to serve files that are hosted in a share that the web server accesses across the network.

How do I grant this user account access to the remote file share? Is this common? What is the best practice for this?

share|improve this question
    
Did you add an ACE for computername\IUSR_Machine on the machine hosting the share? Of course for this to work, the machines would need to be domain members. –  Greg Askew Jan 9 '12 at 20:21
    
Hey Greg, both machines are domain members... the anonymous account on the IIS machine is the default anonymous account that was defined when IIS was configured. I'm wondering if I should change the anonymous access user account to a domain user account defined specifically for this purpose. The problem is that the existing account has access to local files/folders defined potentially in many places. If I change the user account, I've got to go and redefine its access everywhere it already has access. –  BenAlabaster Jan 9 '12 at 20:31
add comment

2 Answers

Use a domain user account as the anonymous account instead, and grant access to that account. You can do this all the way down to on a per-page basis, so you might not need to edit any permissions already used by IUSR_MACHINE on the local box if it's a specific page or request that triggers the remote file share access.

The tool SUBINACL could be used to replace local IUSR_MACHINE ACLs with the new user, but be careful; it's easy to screw up the permissions with that as well.

You could also experiment with allowing Machine$ connections to that share, but I suspect it'll be a null user rather than the machine account in most cases; you might have a case where that's not, uh, the case.

share|improve this answer
add comment

I would add an Access Control Entry (ACE) for the webserver\IUSR_Machine account to the share/ntfs permissions.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.