15

i'm using IIS7 express and therefore need to unblock port 80 if I wish to hit the website locally and on the default http port. To do this, i use ..

netsh http add urlacl url=http://my.custom.locahost.domain.com:80/ user=mydomain\myusername

is it possible to say something like

netsh http add urlacl url=*:80/ user=*

so basically, anything going to port 80, by anyone, is allowed?

5

See here: http://msdn.microsoft.com/en-us/library/ms733768.aspx which shows this:

netsh http add urlacl url=http://+:80/MyUri user=DOMAIN\user

My understanding is that it will listening to anything at port 80 and if you want it linked to a specific address, you'd actually have to unbind it. That's what I have to do if I want to run IIS and Apache on the same box with both listening to port 80.

For the user, domain\domain users should be a valid domain group which includes everyone.

2
  • 2
    I found that I had to use * instead of +. My binding looks like <binding protocol="http" bindingInformation="*:1421:*"/>. Why does + work for you?
    – binki
    Mar 26 '15 at 14:44
  • 1
    @binki Both are valid with slightly different purposes. See Routing Incoming Requests for further information.
    – lauxjpn
    Dec 30 '20 at 15:02
25
netsh http add urlacl url=http://+:80/ user=Everyone

Note that the valid value for user actually depends on your system language (Everyone for English, Jeder for German).

5
  • 4
    +1 For the localization information
    – Basic
    Mar 1 '15 at 23:34
  • "Tout le monde" for French
    – Drakkin
    Sep 19 '16 at 8:51
  • I think, Jeder (GER) and Everyone (ENG) and Ĉiuj (ESO) and Каждый (RUS) are ridiculous... But it is MS-approach, and who am I to judge them... Apr 18 '18 at 1:08
  • I really thought this was a joke until the moment I saw it working.
    – Tarc
    May 28 '18 at 23:49
  • System.Security.Principal.SecurityIdentifier sid = new System.Security.Principal.SecurityIdentifier(System.Security.Principal.WellKnownSidType.WorldSid, null); System.Security.Principal.NTAccount acct = sid.Translate(typeof(System.Security.Principal.NTAccount)) as System.Security.Principal.NTAccount ; Console.WriteLine(acct.ToString()); ...as posted by user "LucVK-T" on social.msdn
    – oo_dev
    Aug 26 '19 at 13:50
14

Basing on @jgillich answer, I propose to do the following:

netsh http add urlacl url=http://+:80/ sddl=D:(A;;GX;;;S-1-1-0) 

sddl argument will be virtually the same as user, but you don't need to think of a localized group name. So, it's more universal.

10
  • 1
    Wouldn't it be better to use S-1-2-0 to only use local users? Aug 14 '15 at 5:38
  • 1
    @DenisV do you have any documentation what "D:(A;;GX;;;S-1-1-0)" means?
    – Peter
    Aug 22 '16 at 9:36
  • 2
    @Peter maybe this can be an answer: itconnect.uw.edu/wares/msinf/other-help/…
    – Denis V
    Aug 22 '16 at 18:12
  • 1
    @DenisV thanks that explains the first part but not S-1-1-0 and S-1-2-0 but it will do!
    – Peter
    Aug 23 '16 at 6:27
  • 1
    @Peter, here you have more information Feb 8 '17 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.