0

Trying to add a folder on D:\ as a virtual directory to a Web Site in IIS.

"Obviously" I need to add an ACL to the folder for the security principal IIS uses. This appears, most of the time, to be IIS_IUSRS.

I was about to do this

icacls D:\sites /grant:r "IIS_IUSRS":(OI)(OC)RX

but first I went to check what IIS did for C:\Inetpub\wwwroot, but when I ran icacls c:\Inetpub\wwwroot I got the following

    BUILTIN\IIS_IUSRS:(RX)
    BUILTIN\IIS_IUSRS:(OI)(CI)(IO)(GR,GE)

So I was wondering what the effective difference is between (GR,GE) and RX? and/or if there is a 'more correct' way to ensure that a folder has the correct permission set to be used as an IIS content root.

And, as a followup - If I do point a virtual directory at, say "D:\test", IIS is quite happy to serve content from that folder despite no explicit IIS_IUSRS entries. Probing the ACL I get this:

test BUILTIN\Administrators:(I)(F)
     BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
     NT AUTHORITY\SYSTEM:(I)(F)
     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
     NT AUTHORITY\Authenticated Users:(I)(M)
     NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
     BUILTIN\Users:(I)(RX)
     BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)

What accounts do I need to remove so I can continue to safely backup and deploy to this folder, but IIS actually honours IIS_IUSRS?

0

These permissions are not the same. RX is stronger, but the difference might not be meaningful for you.

GR and GE are generic permissions which include read, write and traversal. RX also includes the permission for "Read extended attributes", which is not required for IIS. Extended attributes are defined by programs, so may vary, and most probably you have none.

In your case, both will work, although they are not identical. However, it is always advisable to limit permissions on IIS folders to the very limit, because some permissions may be used by hackers in unforeseen ways.

See this article which dissects all NTFS permissions.

  • On the subject of minimum permissions, I see that IIS doesn't even care about IIS_IUSRS on "random" folders. So I need to both figure out the minimum permission to apply for IIS_IUSRS, but also the permissions to reset/remove so IIS honours them. – Chris Becke Sep 18 '18 at 11:29
  • I suggest copying exactly the IIS defaults, because they are the safest. – harrymc Sep 18 '18 at 12:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.