Let's say I have the following setup:

  • Office network that has an Active Directory server
  • Off-site IIS server

I would like to turn off anonymous access on certain folders on the website with the same, so that users have to authenticate with their Active Directory credentials. I have two questions:

  • What are the steps to do this?
  • Is there a way to have a copy of AD on the IIS machine in case the office network goes down (power outage, etc)?
  • for a server to be able to authenticate users agains an AD the server itself must be a member of the domain.
    – yrk
    Mar 3, 2012 at 19:54
  • Who says the server OS needs to do it? Mar 3, 2012 at 23:44
  • @yarek - Okay. How do I do this? Do I need a VPN connection from the web server to the AD server?
    – anon
    Mar 5, 2012 at 16:24
  • @MathiasR.Jessen - I don't understand what you are asking. Who are you directing the question towards?
    – anon
    Mar 5, 2012 at 16:25
  • @anon you don't necessarily have to use Windows' built-in security providers for authentication agains AD, since AD is just an LDAP implementation. You could use openLDAP or another plugin for authentication against AD... or PHP's LDAP feature: davidschultz.org/blog/2008/4/10/… Mar 5, 2012 at 17:19

1 Answer 1


The normal steps to do this would be:

  1. Join the web server to the domain
  2. Enable Windows Authentication
  3. Set the appropriate NTFS ACLs on the folders that you want to secure
  4. Disable anonymous access to those folders

If the web server cannot me made a member of the domain, you can use third-party or home-grown code to forward the username and password to AD for authentication and only serve up the content upon successful auth, but this is substantially more work usually and implementation would be specific to your configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .