I created a virtual directory called test (C:\test) under the Default Web Site and added two simple test files (one html and one aspx). I thought I had to add the IUSR and NetworkService (for application pools) to C:\test and grant the users appropriate rights in order for IIS7 to serve the content.

It appears that is not the case at all as I can view any files in the virtual directory (even if I convert it to an application) without changing or adding any security settings on the C:\test folder.

I just installed IIS7 with ASP.NET on Windows 2008 without changing any settings besides adding the virtual directory. Am I missing something? Even my book on IIS7 states that the user accounts should be added an appropriate rights should be added.

I added the following to answer the comments:

I am referencing the file using a public IP http://xxx.xxx.xxx.xxx/test/one.html and the IP nor localhost is in my trusted sites. I am not signed in on the server at all as I am accessing the content from my home machine and the content is on my production server. The following users/groups have access to c:\test on the server (Creator Owner, System, Administrators, Users) and the app pool is running under the default NetworkService account.

I basically installed win2008, added the IIS role with asp.net. I then opened IIS7, added a virtual directory and copied two files to the directory to test. It works which is great but I want to understand why it works. How is it that IIS7 can access files in the C:\test folder without any permissions set.

  • Some additional info might help: Are you referencing the files as: localhost/test/one.html ? Is localhost already in your browser's trusted sites? Are you signed in as administrator? What are the permissions on the files in c:\test? What user is the app pool running under? – qxotk Jan 12 '10 at 0:56
  • I edited the post to add the information you asked for. – Thomas Jan 12 '10 at 1:48

First, A virtual directory does not have a drive letter on it (C:). There may be a path backing your virtual directory, but that's not the virtual directory. This article is a good overview.

It's possible you are using authenticated access, in which case your Windows ID is being passed through to IIS, which then grants you access to the files in question.

I don't have a WS2008 to try this out, so I can't be sure.

  • The virtual directory is called "test" and located in C:\test. I am not using authenticated access, just anonymous access. – Thomas Jan 11 '10 at 23:45

Check your administrators and users groups and see what's inside those groups, somehow the IUSR account has rights to view the folder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.