As a learning experience I'm setting up (and trying to harden) a Windows 2008R2 web server.

My web sites are stored on a separate partition and are organized as below:


I've removed the default permissions for the "Users" group from the "domains" directory.

Here are the permissions for /domains

           CREATOR OWNER:(OI)(CI)(IO)F 

Each web site is configured with a separate application pool running under AppPoolIdentity.

I've granted modify rights to the "wwwroot" for the appropriate application pool user and read permissions for the anonymous user:

D:\domains\somedomain.com\wwwroot IIS APPPOOL\somedomain.com:(OI)(CI)C 
                                    NT AUTHORITY\IUSR:(OI)(CI)R 
                                    NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F 
                                    CREATOR OWNER:(OI)(CI)(IO)(ID)F 

Is there anything else that I am missing regarding the directory permissions?


I'm doing something similar, but still differently:

  1. Why do you need Modify rights granted to wwwroot folder? Read & Execute is enough and only grant Modify when required (e.g. temp, upload, cache folders -- where content will be created/changed, for example by website app (PHP/ASP.NET etc)).

    I grant "Read & Execute" to D:\domains\somedomain.com (it is enough) and Modify to a specific folders: D:\domains\somedomain.com\var. If I have an app/script that requires Modify right on web-accessible folder (for example, LiveZilla live chat software), then I grant it there, e.g. D:\domains\somedomain.com\wwwroot\livechat\banners.

  2. I do not use IUSR user -- I'm using "Application pool identity" instead:

    • "Application user (pass-trough authentication)" on "Site | Basic Settings | Connect as"
    • and "Application pool identity" on "Site | Authentication | Anonymous Authentication"
  3. I do not have "CREATOR OWNER" at all (it was causing problems when running PHP scripts -- unable to execute them at all + something else (don't remember now), so I have removed it from the whole D:\domains). I pretty much have: SYSTEM, Admins, APP_POOL_SPECIFIC_ID, SPECIFIC_FTP_USER.

The above works fine for me on 6 servers with no issues so far (Am I lucky?).

  • 1. The application requires write access, but you're right I should really just allow right access to specific directories. 2. I prefer to keep the identity of my application pool (that the web site runs under) and that of my web site visitors separate. – Ben Aug 30 '11 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.