Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up our websites to only allow access from users in certain AD groups using windows authentication but i can't seem to make it work. I've tried using IIS's authorization and restricting it to those groups only, but i don't have access from users that are in those groups. This seems like something that's supported, but I can't get it to work.

The pages are completely in .net as well, so i've tried specifying

<identity impersonate="true"/>
<authentication mode="Windows" />
  <allow users="Domain\ProgramUsers"/>
  <deny users="?"/>

in the web.config but then it allows people in who aren't part of the Program Users group, which doesn't make a lot of sense to me.

share|improve this question

I think you need to specify:

Deny users="*"

At the moment you're blocking access only to non-authenticated users, i.e. regardless of group membership.

share|improve this answer
At that point i'm unable to access the site from either user. – Kravlin Oct 17 '12 at 20:22
Try including <identity impersonate="true"/> before the authorization node – darth_phoenixx Oct 17 '12 at 20:26
Already have it. I'll add that to the above information. Sorry about that. – Kravlin Oct 17 '12 at 20:27
Hmm.. ok. Couple of other things to try: check the case of your domain and group name - it believe the case needs to be correct e.g. ProgramUsers not programusers. Also, and forgive me this is not meant to be patronizing but is this definitely a security group and not a distribution group? – darth_phoenixx Oct 17 '12 at 20:47
Ah! Lightbulb moment. Try <allow roles="domain\group"/> rather than <allow users="domain\group"/> – darth_phoenixx Oct 17 '12 at 20:51

Try using <allow roles="domain\group"/> instead of <allow users="domain\group"/> like mikrose suggested. It's how we have it setup on some of our internal sites and it seems to be working for us along with the <deny users="*"/> and we do not have impersonate explicitly set.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.