A very weird issue that never encountered with Windows Server 2003: when configuring basic authentication to restrict access to specific directories in IIS7 I've done the following:
- Enabled basic authentication and disabled anonymous authentication for specific directories within IIS7
- Created three Active Directory groups: site.com Staff, site.com Members, site.com Something.
- Created multiple accounts and added to applicable group.
- Given Read & Execute NTFS permissions to a specific domain group/s to three areas of an IIS7 site
However, any domain account from any of the three groups can access any of the other three areas of the site once logged in. The only way to truly lock down a directory is not only providing read rights to the applicable group, but denying access to the groups that should not have access. This does not make sense apart from the fact that of course, a member of the Domain Users group is a part of the Local Users group, and you cannot deny access to either for the directories in question.
What obvious thing am I missing?
Update: Embarrassed to say that this was a pretty obvious one and has nothing to do with Win2003 vs. Win2008.
For all applicable directories/files:
- Enable Basic Authentication in IIS, and remove anonymous.
- Remove inheriting permissions (with copy to make things easy)
- Remove local Users group access
- Grant the applicable domain groups read access
- Add Network Service read access (this is specific for IIS7 because of the integrated pipeline)
As you can see, the only Win2003 vs. Win2008 issue is granting Network Service access to the resource in question.