15

i'm using IIS7 express and therefore need to unblock port 80 if I wish to hit the website locally and on the default http port. To do this, i use ..

netsh http add urlacl url=http://my.custom.locahost.domain.com:80/ user=mydomain\myusername

is it possible to say something like

netsh http add urlacl url=*:80/ user=*

so basically, anything going to port 80, by anyone, is allowed?

4 Answers 4

5

See here: http://msdn.microsoft.com/en-us/library/ms733768.aspx which shows this:

netsh http add urlacl url=http://+:80/MyUri user=DOMAIN\user

My understanding is that it will listening to anything at port 80 and if you want it linked to a specific address, you'd actually have to unbind it. That's what I have to do if I want to run IIS and Apache on the same box with both listening to port 80.

For the user, domain\domain users should be a valid domain group which includes everyone.

2
  • 2
    I found that I had to use * instead of +. My binding looks like <binding protocol="http" bindingInformation="*:1421:*"/>. Why does + work for you?
    – binki
    Commented Mar 26, 2015 at 14:44
  • 1
    @binki Both are valid with slightly different purposes. See Routing Incoming Requests for further information.
    – lauxjpn
    Commented Dec 30, 2020 at 15:02
28
netsh http add urlacl url=http://+:80/ user=Everyone

Note that the valid value for user actually depends on your system language (Everyone for English, Jeder for German).

5
  • 4
    +1 For the localization information
    – Basic
    Commented Mar 1, 2015 at 23:34
  • "Tout le monde" for French
    – Drakkin
    Commented Sep 19, 2016 at 8:51
  • I think, Jeder (GER) and Everyone (ENG) and Ĉiuj (ESO) and Каждый (RUS) are ridiculous... But it is MS-approach, and who am I to judge them... Commented Apr 18, 2018 at 1:08
  • I really thought this was a joke until the moment I saw it working.
    – Tarc
    Commented May 28, 2018 at 23:49
  • System.Security.Principal.SecurityIdentifier sid = new System.Security.Principal.SecurityIdentifier(System.Security.Principal.WellKnownSidType.WorldSid, null); System.Security.Principal.NTAccount acct = sid.Translate(typeof(System.Security.Principal.NTAccount)) as System.Security.Principal.NTAccount ; Console.WriteLine(acct.ToString()); ...as posted by user "LucVK-T" on social.msdn
    – oo_dev
    Commented Aug 26, 2019 at 13:50
16

Basing on @jgillich answer, I propose to do the following:

netsh http add urlacl url=http://+:80/ sddl=D:(A;;GX;;;S-1-1-0) 

sddl argument will be virtually the same as user, but you don't need to think of a localized group name. So, it's more universal.

10
  • 1
    Wouldn't it be better to use S-1-2-0 to only use local users? Commented Aug 14, 2015 at 5:38
  • 1
    @DenisV do you have any documentation what "D:(A;;GX;;;S-1-1-0)" means?
    – Peter
    Commented Aug 22, 2016 at 9:36
  • 2
    @Peter maybe this can be an answer: itconnect.uw.edu/wares/msinf/other-help/…
    – Denis V
    Commented Aug 22, 2016 at 18:12
  • 1
    @DenisV thanks that explains the first part but not S-1-1-0 and S-1-2-0 but it will do!
    – Peter
    Commented Aug 23, 2016 at 6:27
  • 1
    @Peter, here you have more information Commented Feb 8, 2017 at 12:10
1

My best guess was to set exactly the same url you add to the listener and do:

 netsh http add urlacl url="[exact same value]" user=%USERDOMAIN%\%USERNAME%

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .