To allow users to connect to my server remotely, I added the domain group Domain Users to the local group on my server Remote Desktop Users. These users can login to the server remotely but when they open IIS Manager, they do not have access to any of the sites.

How do I give my remote users access to IIS Manager? I am looking for a solution (if there is one) that does not require me to make them administrators.

  • I've gotten as far as giving members of the local group Remote Desktop Users access to an individual site by the following the steps outlined here, technet.microsoft.com/en-us/library/cc753695(v=ws.10).aspx, but these users do not have access to the application pool area. How do I give these users access to the application pools in IIS? – Barbosa May 13 '13 at 15:04
  • What are you trying to accomplish? If you're asking them to manage IIS sets (or allowing them to manage all IIS sites, including application pools), what kind of users are they if not administrators? Depending on what other needs they have on the server, you might consider revoking remote desktop rights, but allowing them to use the remote IIS Management tool instead: iis.net/learn/manage/remote-administration/…. Would that work, or do to have to use the desktop? – SqlRyan May 13 '13 at 16:30
  • @SqlRyan - I don't really think of these users as Administrators. For example, I don't want them to be able to restart or shutdown the server, change firewall settings, install and uninstall programs, manage security settings such as local users, local groups, etc... I thought about the IIS Remote Management tool but these users also need access to the file system. And I know file system access can be done with FTP. Maybe that's the best option: Remote IIS Manager + FTP access. Is that what you recommend? – DougCouto May 13 '13 at 16:59

Given your requirements, I'd probably recommend a combination of IIS remote administration and some kind of either FTP or file share access to the relevant folders. It doesn't sound like there's actually any requirement for them to log into the desktop directly, and I'd generally have them avoid doing that on a server. As it's difficult to grant granular permissions to allow IIS administration, but not allow much else, you'd be better off going with the remote admin tool that's built to support what you're looking for.



Use the IIS Manager Permissions feature page to manage IIS Manager users, Windows users, and members of Windows groups that are allowed to connect to a site or an application. Users can configure delegated features in any sites and applications to which you grant them permission from the IIS Manager Permissions page.

This feature is available only for server connections. When you open the feature at the server level in IIS Manager, you can view the users who are granted permission to all sites and applications on the Web server, and you can select a user to remove the user's permission to a site or an application. To grant a user permission to a site or an application, you must select the site or application and then open the IIS Manager Permissions feature to configure the users who are allowed to connect to that site or application.

Read the rest http://technet.microsoft.com/en-us/library/cc742464.aspx

  • Tom - thank you for your answer. This is how I currently have it configured, however, this approach requires that I give Windows Users or Windows Groups access to a Site or Application one by one. Also, this approach does not give Users access to the Application Pools in IIS Manager. I'm looking for a solution that would give Users full access to IIS Manager without making them Admins. It's starting to seem like there is no way to do what I'm asking. – DougCouto May 14 '13 at 13:42
  • I have not tried it but I found this, maybe it will assist. blogs.iis.net/krolson/archive/2009/11/12/… – Tom May 14 '13 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.