Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to lock down the web.config file as much as possible, so that as few accounts as necessary can read the file. I saw the list here but allowing the Users group read permission on the web.config file seems excessive. Thanks.

share|improve this question
Lock it down from whom? Internal users, local access on the machine, internet users? – GregD Sep 23 '09 at 22:30

The Users group would of course apply to the local machine. What are you worried about them reading in the web.config? If it's your connection strings, you can encrypt those.

share|improve this answer

You do have to worry about users reading web.config files. Especially, if you are allowing users access to your file system.

I've tried removing user permissions to the web.config and allowing only the anonymous IIS account and the IIS app pool process account access to the file, and the application still works.

Encrypting the files on top of that will probably help even more, as well. If anyone has an official solution on this, please let us know.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.