Setting IIS8 security - removing the "Users" group from c:\ and system folders.

Posted on 2013-01-04
Medium Priority
Last Modified: 2014-08-22
I have an win2012/IIS 8 webserver which I am trying to secure. I want to isolate each site/user to their own folder as best as possible.

I have moved the websites to "c:\sites\mysiteA\", "c:\sites\mysiteB\" and so on.

I have setup separate user accounts for each website and set minimum permissions for the folder (including removing the "Users" group.)

removed non essential users from other data folders like the MSSQL database folders.

However "c:\" and all system folders have by default read/execute access for the "Users" group.

I have read that recent editions of IIS are secure out of the box but allowing IIS users to read and execute system files doesn't seem secure to me.

Is it normal to leave the server like this?

Can anyone suggest what the best practice is from this point. Should the "Users" group be removed from "c:\" or perhaps a DENY rule added for IIS users.

These seem like drastic changes and I'm not sure if they would effect the running of IIS or SQL Server 2012. Only the administrator logs into the desktop so there are no other physical users.
Question by:meagord
LVL 30

Accepted Solution

Brad Howe earned 2000 total points
ID: 38746049
Yes, this is normal. Those permissions are very restrictive and require access thorugh RDP to the server.

Since you are using isolation, I would suggest the following approach;

1. Remove the local accounts from the local USERS Group.
2. Remove Inheritence from the c:\sites\x directories.
3. Remove USERS group permissions
4. Add "local user 1/2/3" permissions as

Read & execute
List folder contents

To explain further, since you do not seem to have any network shares, there is no concern since they cannot RDP or access admin shares (X$).

Hope it helps,

Author Comment

ID: 38750560
Thanks for the reply.

1. Remove the local accounts from the local USERS Group.


2. Remove Inheritence from the c:\sites\x directories.


3. Remove USERS group permissions

From where?

4. Add "local user 1/2/3" permissions as Read & execute List folder contents Read

Again where?

I tried removing the separate web user accounts from the Users group but somehow they still seems to have the same rights as the "Users" group.  I'm wondering if IIS 8 automatically gives them these rights when it joins them to the iis_iusrs group automatically.

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

The following article is comprised of the pearls we have garnered deploying virtualization solutions since Virtual Server 2005 and subsequent 2008 RTM+ Hyper-V in standalone and clustered environments.
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question