Trying to add a folder on D:\ as a virtual directory to a Web Site in IIS.
"Obviously" I need to add an ACL to the folder for the security principal IIS uses.
This appears, most of the time, to be
I was about to do this
icacls D:\sites /grant:r "IIS_IUSRS":(OI)(OC)RX
but first I went to check what IIS did for C:\Inetpub\wwwroot, but when I ran
icacls c:\Inetpub\wwwroot I got the following
So I was wondering what the effective difference is between (GR,GE) and RX? and/or if there is a 'more correct' way to ensure that a folder has the correct permission set to be used as an IIS content root.
And, as a followup - If I do point a virtual directory at, say "D:\test", IIS is quite happy to serve content from that folder despite no explicit
IIS_IUSRS entries. Probing the ACL I get this:
test BUILTIN\Administrators:(I)(F) BUILTIN\Administrators:(I)(OI)(CI)(IO)(F) NT AUTHORITY\SYSTEM:(I)(F) NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F) NT AUTHORITY\Authenticated Users:(I)(M) NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M) BUILTIN\Users:(I)(RX) BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
What accounts do I need to remove so I can continue to safely backup and deploy to this folder, but IIS actually honours