Looking at the default security permissions of "wwwroot", I see that "IIS_IUSRS" has multiple permissions : Read&execute/List folder content/Read.
However, when I delete this group, the default website is always working.
Moreover, i already created other websites at the root of inetpub folder without the need to add this group.
So, all my websites work with the following security groups : Creator owner/System/Administrators/Users/TrustedInstaller.

Do I really need to add "IIS_IUSRS" to every website ?
Do I have a security problem if it works without this group ? So, do I need to remove one of the default groups ?


No, you don't need IIS_IUSRS to secure a site, you don't need it at all. The reason why your sites still work without it, that the 'Users' group still has permission to it.

To make your sites more secure you would need to remove any permissions to Users and set appropriate permissions for whichever account you are using in IIS.

Before changing security settings, make sure you know what you are doing. Read more about it and test your new settings.

I wrote a bit about IIS file permissions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.