Avatar of meagord
meagord
 asked on

Setting IIS8 security - removing the "Users" group from c:\ and system folders.

I have an win2012/IIS 8 webserver which I am trying to secure. I want to isolate each site/user to their own folder as best as possible.

I have moved the websites to "c:\sites\mysiteA\", "c:\sites\mysiteB\" and so on.

I have setup separate user accounts for each website and set minimum permissions for the folder (including removing the "Users" group.)

removed non essential users from other data folders like the MSSQL database folders.

However "c:\" and all system folders have by default read/execute access for the "Users" group.

I have read that recent editions of IIS are secure out of the box but allowing IIS users to read and execute system files doesn't seem secure to me.

Is it normal to leave the server like this?

Can anyone suggest what the best practice is from this point. Should the "Users" group be removed from "c:\" or perhaps a DENY rule added for IIS users.

These seem like drastic changes and I'm not sure if they would effect the running of IIS or SQL Server 2012. Only the administrator logs into the desktop so there are no other physical users.
Microsoft IIS Web ServerWindows Server 2012

Avatar of undefined
Last Comment
meagord

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Brad Howe

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
meagord

ASKER
Thanks for the reply.

1. Remove the local accounts from the local USERS Group.

Done

2. Remove Inheritence from the c:\sites\x directories.

Done

3. Remove USERS group permissions

From where?

4. Add "local user 1/2/3" permissions as Read & execute List folder contents Read

Again where?


I tried removing the separate web user accounts from the Users group but somehow they still seems to have the same rights as the "Users" group.  I'm wondering if IIS 8 automatically gives them these rights when it joins them to the iis_iusrs group automatically.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck