0

I have a intranet site running on IIS 7.5 with Windows Auth. If I don't share that folder with "everyone" then users are prompted with many login requests and it ultimately doesn't work at all. If the web directory must be shared, then that's fine. I'd just like to know. But it seems wrong to give everyone the ability to browse that directory. They can see all the content in windows explorer.

IUSR and IIS_USRS are already granted read permission to the web dir. Giving them write doesn't help. I'm using application user pass- through authentication for the site and Windows Authentication is the only auth method enabled.

So, is that just the way it is or is there another account that needs something there?

Improve this question

2 Answers 2

Reset to default
0

No. It is not necessary.

In IIS manager select the site and open the configuration editor. Set the autheticatedUserOverride value to UseWorkerProcessUser

for further info see http://weblogs.asp.net/owscott/iis-using-windows-authentication-with-minimal-permissions-granted-to-disk

Improve this answer
1
  • This sort of worked, as it let users access the site without the webroot being shared. But it didn't let me identify the Windows User which is critical for my access control, permissions, etc... The user was always NT Authority/System. So, maybe the dir does have to be shared...?
    – SpeedRacer350
    Oct 26, 2015 at 19:35
0

IUSR and IIS_USRS need 'modify' as well as write I believe? but don't trust me on that. it's untested.

However, I do know that (secpol.msc then > Computer Configuration > Windows Settings > Security Settings > Local Policies >Security Options > LanManagerAuthenticationLevel) on the client machine needs to be changed from the default "Send NTLM response only" to "Send LM & NTLM - use NTLMv2 session security if negotiated:" which resolves the issue if the user is on the same domain. Have a look at this: https://technet.microsoft.com/en-us/library/cc738867%28v=ws.10%29.aspx

Rob. edit i know that link refers to 2003 server, but applies equally to 2008/2012 in my experience.

Improve this answer
1
  • Adding modify to the IIS users didn't help. And the security policy modification is an interesting work-around. I don't know if it works, since I couldn't find the option to change. But either way, I can't manipulate the security policies on every computer in the organization. It would be easier to just share the web dir.
    – SpeedRacer350
    Oct 28, 2015 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .