Ok - W2k3 SP1 is the latest - No SP2 yet.
So, you have a standard user isolation setup
with
C:\Inetpub\ftproot\LocalUser\Moe
C:\Inetpub\ftproot\LocalUser\Curly
C:\Inetpub\ftproot\LocalUser\Larry
You have physical folder underneath \Moe\
C:\Inetpub\ftproot\LocalUser\Moe\data
You have a virtual directory at ftproot
ftproot -> C:\Inetpub\ftproot\
|--data -> C:\Inetpub\ftproot\LocalUser\Moe
So when you login as Moe and do a dir listing -
You should see the 'data' folder listing
But when you login as Larry or Curly - you should NOT see
the 'data' folder listing
However, since this is virtual directory - Larry and Curly can
'blindly' navigate to the folder via 'cd data'.
if Larry or other users has READ permission on the mapped path
C:\Inetpub\ftproot\LocalUser\Moe - then he/she will be able to do a dir
listing.
hence - you need to configure proper NTFS permissions to restrict access.
--
Regards,
Bernard Cheah
http://www.iis-resources.com/ http://www.iiswebcastseries.com/ http://msmvps.com/blogs/bernard/ [quoted text, click to view] <franandanna@hotmail.com> wrote in message
news:1136572015.748845.323340@g43g2000cwa.googlegroups.com...
>I have been experimenting with setup of isolated users on IIS6 with
> Windows Server 2003 SP2, and I ran into an issue I don't understand.
>
> I have these 3 local users on the computer: Larry, Curly and Moe.
>
> Within C:\Inetpub\ftproot\LocalUser I have directories called Larry,
> Curly and Moe. Inside only Moe's directory is a subdirectory called
> Data. The FTP site has a virtual directory called Data which is mapped
> to C:\Inetpub\ftproot\LocalUser\Moe\. Larry and Curly do not have any
> subdirectories, and certainly none called "Data".
>
> I have set UserIsolationMode to 1.
>
> I expected only Moe to be able to see the Data virtual directory's
> contents since it's inside /Moe and other users are supposedly isolated
> to their own directories. However I can log on as Larry and ask for
> /Data and I can see its contents.
>
> How come Larry and Curly are able to see inside a virtual directory
> which is mapped to Moe's (isolated) directory space?
>
> Is there a way to disallow it?
>
> Thanks
>
