IIS Permissions Problem

IIS Permissions Problem

Post by John McGuir » Thu, 17 Oct 1996 04:00:00



I'm running an Intranet on NT4.0, IIS 2.0 and IE 3.0 (with patch) and
Anonymous, Basic and NT Challenge/Response all enabled. All users and
groups are 'Log on Locally' for web access.

I have the Admin group (Full), WebMIS group (Change) and Everyone (RX) on
all content and all is fine. However, I have a subdirectory NewProjects
which has permissions as Admin group (Full), WebMIS group (Change) and
WebNewProjects (RX) . I get access denied for all users (including
WebNewProjects and WebMIS) except members of the Admin group.

If I add IUSR_computer to the Admin group, all users can then see all
pages. If I then remove IUSR_computer from the Admin group and restart IIS,
all users can still see all pages for about an hour or so and then get
denied to NewProjects.

Does anyone have any ideas on my permissions problem and why the group
change takes so long to take effect.

Regards John McGuire

----------------------------------------------------------------------------
--

Web: http://www.ramsayhealth.com.au/~atarazi/
----------------------------------------------------------------------------
--

 
 
 

IIS Permissions Problem

Post by Mike Conn » Fri, 18 Oct 1996 04:00:00



> I'm running an Intranet on NT4.0, IIS 2.0 and IE 3.0 (with patch) and
> Anonymous, Basic and NT Challenge/Response all enabled. All users and
> groups are 'Log on Locally' for web access.
> I have the Admin group (Full), WebMIS group (Change) and Everyone (RX) on
> all content and all is fine. However, I have a subdirectory NewProjects
> which has permissions as Admin group (Full), WebMIS group (Change) and
> WebNewProjects (RX) . I get access denied for all users (including
> WebNewProjects and WebMIS) except members of the Admin group.
> If I add IUSR_computer to the Admin group, all users can then see all
> pages. If I then remove IUSR_computer from the Admin group and restart IIS,
> all users can still see all pages for about an hour or so and then get
> denied to NewProjects.
> Does anyone have any ideas on my permissions problem and why the group
> change takes so long to take effect.

> Regards John McGuire
> ----------------------------------------------------------------------------
> --

> Web: http://www.ramsayhealth.com.au/~atarazi/
> ----------------------------------------------------------------------------
> --

I have been having similar problems. It seems that if I disallow anonymous
logins, the only user ID that I can successfully log in as is Administrator.
In a fit of desperation, I've added IUSR_computer, as well as my normal
user ID, full rights, and I still get the same result.

This may be related to a similar problem I was having trying to debug an
ISAPI extension. If I ran the inetinfo as an application using the -e W3Svc
(see article TN063 - in the Knowlege Base, I believe), every time I tried
to access the server from IE 3.0, I would get:

        HTTP/1.0 500 Server Error (A privilege is not held by the
        client.)

I have full rights on Administrator, my login, and IUSR_computer, so I don't
see how this could be right.

--
Michael Conner
Enforcer Technology


 
 
 

IIS Permissions Problem

Post by Klaus D. Witze » Sat, 19 Oct 1996 04:00:00


There are authentication problems in certain situations, would be necessary
you post

  o is your IIS a primary|secondary domain controler or just server
  o are those accounts global or just local to the IIS machine
  o is there any cross-(MS)-domain access involved

To the three items above there is ongoing discussion in the
microsoft.public.* newsgroups. Of not so much help by now, but who knows...

/Klaus

P.S. my IMN didn't like to cross-post over to
microsoft.public.inetserver.iis ;-)



| I'm running an Intranet on NT4.0, IIS 2.0 and IE 3.0 (with patch) and
| Anonymous, Basic and NT Challenge/Response all enabled. All users and
| groups are 'Log on Locally' for web access.
|
| I have the Admin group (Full), WebMIS group (Change) and Everyone (RX) on
| all content and all is fine. However, I have a subdirectory NewProjects
| which has permissions as Admin group (Full), WebMIS group (Change) and
| WebNewProjects (RX) . I get access denied for all users (including
| WebNewProjects and WebMIS) except members of the Admin group.
|
| If I add IUSR_computer to the Admin group, all users can then see all
| pages. If I then remove IUSR_computer from the Admin group and restart
IIS,
| all users can still see all pages for about an hour or so and then get
| denied to NewProjects.
|
| Does anyone have any ideas on my permissions problem and why the group
| change takes so long to take effect.
|  
| Regards John McGuire
--
Sending out unsolicited e-mail is an abuse of the Internet, and is totally
unacceptable. Any spam received by me will be read for a charge of US$100
per message.

 
 
 

IIS Permissions Problem

Post by Mike Conn » Wed, 23 Oct 1996 04:00:00



Quote:> There are authentication problems in certain situations, would be necessary
> you post
>   o is your IIS a primary|secondary domain controler or just server
>   o are those accounts global or just local to the IIS machine
>   o is there any cross-(MS)-domain access involved
> To the three items above there is ongoing discussion in the
> microsoft.public.* newsgroups. Of not so much help by now, but who knows...
> /Klaus

OK, I've found that there are some registry entries which need to be
modified.  I was running IIS on a plain server (not primary or secondary),
and there is a parameter called "DefaultLogonDomain" in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters
which, I think, should be set to the correct domain.  That seems to
have at least allowed me to log on using clear text and winnt chanllenge,
response.  However, now anonymous doesn't seem to be working. But that may be
another issue.