IIS Server Security - IUSR and IWAM accounts in Active Directory

Author

IUSR and IWAM accounts in Active Directory

Hiro

2005-09-20, 6:05 pm

Our web servers (IIS 6/ WIN2k3) need access to a file server. I would like to
create the IUSR and IWAM accounts under active directory and grant access to
the web server through one of these accounts.
My questions regarding this setup are:

What rights do the IUSR and IWAM accounts need to do their jobs correctly?
Are there any white papers explaining this?
Am I taking the best approach for what needs to be done?

Chris Crowe [MVP]

2005-09-22, 7:50 am

Basically just add the accounts you create to the LOCAL machine group called
IIS_WPG

This will ensure that the accounts have the correct permission for the IIS
Worker Processes

Also you may need to grant rights to the new accounts (or the IIS_WPG) for
any writing to folders on the IIS Servers

--
Cheers

Chris

Chris Crowe [IIS MVP]
http://blog.crowe.co.nz

"Hiro" <Hiro@discussions.microsoft.com> wrote in message
news:B0EC35B6-5815-4451-A8CF-78DCD058EA18@microsoft.com...
> Our web servers (IIS 6/ WIN2k3) need access to a file server. I would like
> to
> create the IUSR and IWAM accounts under active directory and grant access
> to
> the web server through one of these accounts.
> My questions regarding this setup are:
>
> What rights do the IUSR and IWAM accounts need to do their jobs correctly?
> Are there any white papers explaining this?
> Am I taking the best approach for what needs to be done?