Groups | Blog | Home
all groups > iis security > september 2003 >

iis security : IIS 5.0-6.0 Virtual Directory Permissions Issue


raoul NO[at]SPAM keinetworks.com
9/12/2003 8:15:04 AM
Hi,

I'm trying to upgrade from a server 2000 domain to a non-domain server
2003 environment but IIS is holding me back.

It seems that when I create a virtual directory on another server
users cannot see the files. If I have a domain this is no problem. I
have tried changing all security/permission settings but nothing
works. The weird problem is IIS 6 shows the Virtual Directory and all
of its contents with no red flag. However when users connect to the
site they have no access to the contents of the virtual directory.

I know that if I add Active Directory it will fix this problem but I
don't want to and shouldn't have to. This appears to be a carry over
problem from IIS 5. I don't understand why the virtual directory
wizard would ask you for logon credentials and then not work.

Does anyone have any idea how to make IIS Virtual Directories work
David Wang [Msft]
9/12/2003 12:15:05 PM
IIS Virtual Directory works without Active Directory. I think the problem
here is user error.

First, define "However when users connect to the site they have no access to
the contents of the virtual directory." -- are they getting access denied
(401), or 404, or ???

If you upgraded from a server that was in a domain to a server that is not
in a domain, the filesystem may be ACL'd to domain user accounts that are no
longer available to the standalone server (user authentication/ACL is
something that a domain provides which you've just taken away). That fact
itself can cause a 401, and there are two ways to correct this user error:
1. Put the server back in the domain so that the ACLs on the resources match
the credentials that the users are using
2. Reset all the ACLs of the resources on the server as well as reconfigure
IIS to request the right credentials from the remote users.

I think that #1 is a better solution because you have not given sufficient
information on how to do #2.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hi,

I'm trying to upgrade from a server 2000 domain to a non-domain server
2003 environment but IIS is holding me back.

It seems that when I create a virtual directory on another server
users cannot see the files. If I have a domain this is no problem. I
have tried changing all security/permission settings but nothing
works. The weird problem is IIS 6 shows the Virtual Directory and all
of its contents with no red flag. However when users connect to the
site they have no access to the contents of the virtual directory.

I know that if I add Active Directory it will fix this problem but I
don't want to and shouldn't have to. This appears to be a carry over
problem from IIS 5. I don't understand why the virtual directory
wizard would ask you for logon credentials and then not work.

Does anyone have any idea how to make IIS Virtual Directories work
without Active Directory??

Raoul Krakowski
9/12/2003 5:12:51 PM
More info:

These are 2 fresh 2003 server installs without a domain and in the same
workgroup. Server A IIS 6 with Virtual Directory on Server B (windows
media server). I have tried as many combinations of accounts for
anonymous passwords/permissions on the Virtual Folder and even tried
setting up a IUSER_SERVERA account on ServerB. You'd think that since
both servers have the same workgroup/administrator password that it
would work with no problems. I had this same problem with IIS 5 before
going ADS.

What am I missing?




*** Sent via Developersdex http://www.developersdex.com ***
David Wang [Msft]
9/17/2003 5:48:36 PM
Follow the instructions in this whitepaper

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/deploy/confeat/RemStorg.asp

I just configured a IIS6 vdir to use UNC content on another machine, without
domains.

Having identical workgroup/administrator credentials has no effect on UNC
access. Only things you need to synchronize are:
1. What identity is IIS using when retrieving the UNC content
2. What identity is allowed by the UNC share
3. What ACL is on the UNC content itself

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
More info:

These are 2 fresh 2003 server installs without a domain and in the same
workgroup. Server A IIS 6 with Virtual Directory on Server B (windows
media server). I have tried as many combinations of accounts for
anonymous passwords/permissions on the Virtual Folder and even tried
setting up a IUSER_SERVERA account on ServerB. You'd think that since
both servers have the same workgroup/administrator password that it
would work with no problems. I had this same problem with IIS 5 before
going ADS.

What am I missing?




*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

AddThis Social Bookmark Button