2

We are running Microsoft Server 2003 with IIS. We would like to give our developers access to manage IIS (through IIS Admin) but do not want them to be administrators of the entire machine.

Putting them in "Power Users" group does not seem to work.

What permissions should we grant to our developers to allow them to manage IIS (e.g. add websites, modify app pools, etc.) without giving them full admin rights to the server?

2

Install the IIS Management Console onto their local machine, and get them to connect to the server from their local machine. Then you can give them whatever permissions they need on the local machine, disable their ability to log on to an interactive session, and then they can't get up to too much mischief.

This is how IIS servers should be administered anyway, it's generally a bad idea to have admins (let alone devs) logging onto server just to change a minor IIS setting.

The Windows 7 version of the Admin tools (which will administer 2k3 IIS just fine using the IIS 6 management console) can be found here.

  • Thanks. Does this mean they still need Administrator rights on the server (even though you disable remote login access)? – Carl Mar 16 '10 at 6:45
  • 1
    Yes, they still need whatever rights assigned locally to get them access to the IIS, but you can add them into your local administrator group to limit the surface area if they do manage to gain access to the server. Note that adding them to the local administrators also gives them access to the administrative shares on the machine (e.g. \\server\c$) - so you might want to look at locking down those shares as well if local admin is required. – Mark Henderson Mar 16 '10 at 7:19
3

You need to be in the Administrators group to manage IIS in Windows Server 2003. In Windows Server 2008 it is possible using "Feature Delegation" module.

0

I don't think you can give them permission to manage IIS without making them local administrators on windows 2003.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.