Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site that has anonymous access disabled and uses only IIS basic authentication. The site's home directory only has the MACHINENAME\Users group with permissions. I have one user that I don't want to be able to log-in to this site, so I thought all I would need to do is take that user out of the Users group, but doing so still allows him to authenticate. I know it is the Users group that is allowing authentication because if I remove that group's permissions on the directory, he is not allowed to log in.

Is there something special about the Users group that makes it so you are actually always a part of it?

Is the only solution to revoke the Users group's permissions on the site's home directory and grant a new group access that contains only the allowed users?

share|improve this question

How are you limiting the access to just the Users Group? The iis authentication is just authentication, not access control. e.g. if it's an site, you can set access to individual accounts / groups etc.

share|improve this answer
The permissions set on the home directory of the site works as access control. If I revoke the Users group's permissions from the home dir, no one can authenticate thru IIS unless I grant that user explicit permissions to the home dir. – jayrdub Sep 17 '09 at 15:50
So can he authenticate AND still browse that hom dir? If he doesn't have perms then that doesn't make sense. – Quinn Wilson Sep 18 '09 at 16:21
No, he can't authenticate or browse home dir if I remove Users group. He can if I explicitly add the user or if I add back the Users group. – jayrdub Sep 21 '09 at 16:46

Normally, removing a user from a group requires the user to log off and back on as group membership is contained in the access token for the user, so a log off and log on is required in order to get a new access token reflecting the new group membership.

I'm not sure how this works with local groups but have the user log off and back on to their workstation and see if it helps. If not, you might try rebooting the server.

share|improve this answer
The user account is set to not allow logon to the server, it is for access to the website only. – jayrdub Sep 17 '09 at 15:47

Add that user to the site's home directory with an explicit deny?

share|improve this answer

You need to be compatible with the article KB 812614 for the Web site to work in IIS. Add a particular user in the "Deny log on locally" to deny access for that particular user.

share|improve this answer

What does the membership of the Users group look like? Do you by chance have authenticated users or domain users in there?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.