I have a web application which I need to grant permissions to a file share that's hosted on another machine in my DMZ. Users are accessing the application anonymously using the IUSR_Machine account which appears to be the standard configuration. The application needs to serve files that are hosted in a share that the web server accesses across the network.

How do I grant this user account access to the remote file share? Is this common? What is the best practice for this?

  • Did you add an ACE for computername\IUSR_Machine on the machine hosting the share? Of course for this to work, the machines would need to be domain members.
    – Greg Askew
    Jan 9, 2012 at 20:21
  • Hey Greg, both machines are domain members... the anonymous account on the IIS machine is the default anonymous account that was defined when IIS was configured. I'm wondering if I should change the anonymous access user account to a domain user account defined specifically for this purpose. The problem is that the existing account has access to local files/folders defined potentially in many places. If I change the user account, I've got to go and redefine its access everywhere it already has access. Jan 9, 2012 at 20:31

2 Answers 2


Use a domain user account as the anonymous account instead, and grant access to that account. You can do this all the way down to on a per-page basis, so you might not need to edit any permissions already used by IUSR_MACHINE on the local box if it's a specific page or request that triggers the remote file share access.

The tool SUBINACL could be used to replace local IUSR_MACHINE ACLs with the new user, but be careful; it's easy to screw up the permissions with that as well.

You could also experiment with allowing Machine$ connections to that share, but I suspect it'll be a null user rather than the machine account in most cases; you might have a case where that's not, uh, the case.


I would add an Access Control Entry (ACE) for the webserver\IUSR_Machine account to the share/ntfs permissions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .