Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site that has anonymous access disabled and uses only IIS basic authentication. The site's home directory only has the MACHINENAME\Users group with permissions. I have one user that I don't want to be able to log-in to this site, so I thought all I would need to do is take that user out of the Users group, but doing so still allows him to authenticate. I know it is the Users group that is allowing authentication because if I remove that group's permissions on the directory, he is not allowed to log in.

Is there something special about the Users group that makes it so you are actually always a part of it?

Is the only solution to revoke the Users group's permissions on the site's home directory and grant a new group access that contains only the allowed users?

share|improve this question
add comment

5 Answers

How are you limiting the access to just the Users Group? The iis authentication is just authentication, not access control. e.g. if it's an asp.net site, you can set access to individual accounts / groups etc.

share|improve this answer
1  
The permissions set on the home directory of the site works as access control. If I revoke the Users group's permissions from the home dir, no one can authenticate thru IIS unless I grant that user explicit permissions to the home dir. –  jayrdub Sep 17 '09 at 15:50
    
So can he authenticate AND still browse that hom dir? If he doesn't have perms then that doesn't make sense. –  Quinn Wilson Sep 18 '09 at 16:21
    
No, he can't authenticate or browse home dir if I remove Users group. He can if I explicitly add the user or if I add back the Users group. –  jayrdub Sep 21 '09 at 16:46
add comment

Normally, removing a user from a group requires the user to log off and back on as group membership is contained in the access token for the user, so a log off and log on is required in order to get a new access token reflecting the new group membership.

I'm not sure how this works with local groups but have the user log off and back on to their workstation and see if it helps. If not, you might try rebooting the server.

share|improve this answer
    
The user account is set to not allow logon to the server, it is for access to the website only. –  jayrdub Sep 17 '09 at 15:47
add comment

Add that user to the site's home directory with an explicit deny?

share|improve this answer
add comment

You need to be compatible with the article KB 812614 for the Web site to work in IIS. Add a particular user in the "Deny log on locally" to deny access for that particular user.

share|improve this answer
add comment

What does the membership of the Users group look like? Do you by chance have authenticated users or domain users in there?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.