Networks

Ask something
Discussion Locked

IIS: Access Problems

0 helpful
4 replies

by czyjay

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We have just implemented an educational software program throughout our School system that use a web interface and requires IIS on our domain controllers at 38 different schools. After implementation and adding the IIS component all but 2 our our schools can access the program via a web browser. When we try with the 2 school that can't access we get a 3 line domain logon screen. It works fine if you put in the administrator username and password, but we cannot use the anonymous IUSR accountwithout this logon coming up. We can put in the administator account in IIS security access properties and we access fine, but then we have security issues. If any one has a suggestion please let me know.

4 replies

by joseph moore

When you set up IIS on a Windows NT/2K server, you have the option of specifying what type of access to the web site you want to allow.
There are 3 types of access that the IIS web server engine allows.
Anonymous access is the default, wherein to hit the webpage in the browser, the user does NOT specify any logon criteria. They just type in the URL in their browser address bar, click Go, and the IIS server gives them access.
Basic Authentication is the next method. In this one, you have to specify a login name/password to connect to the web page from your browser window. Basic authentication is NOT encrypted or anything liek that; the login and password are transmitted in clear text, that can be sniffed and read. Not a secure way of doing things.
The last way is with Windows Authentication. This way, you have to specify a login name, password and Windows Domain name. No access to the site is allowed to the client in his browser window unless they type in a valid account. The account info is sent to the IIS server using a level of encryption (MD5 hash, I believe), so it is better than Basic. A little more secure.

by joseph moore

Ok, so now the lesson on IIS setup is over. Here is what is going on on the 2 machines. It is either 1 of 2 different scenarios:
1) the web site running on these two machines is set to NOT use Anonymous access. To see, open Internet Services Manager on the 2 machines, go to Properties on the web site, click Directory Security tab, then click the Edit button in the first section "anonymous access and authentication control". If the Anonymous Access checkbox is NOT checked, and only the WindowsIntegrated Authentication box is checked, then you will always get the logon/password box like you are seeing. YOu need to enable Anonymous Access (click its checkbox, then click OK and save changes) to run IIS in the way so that it won't ask for a login/password.

by joseph moore

2) The web site on the 2 machines is running on a NTFS-formatted partition, and the Security level for the folders that contain the website (normally, C:\INETPUB\WWWROOT) do NOT allow the IUSR_"MACHINENAME" account access to the folder. YOu see, thedefault NTFS Security permissions to the WWWROOT folder allows the Everyone group Full Control rights. The IUSR_"MACHINENAME" account falls under the Everyone group, and gets its rights to display the web pages of the site to the clients who requestthem.
IF IUSR does not have rights, then when a person tries to hit a website, they will be presented with the login/password box.
To fix it, just give IUSR account rights to wherever the website is running from (you can tell by going to Properties on the web site in Ineernet SErvices Manager, then click on the HOme Directory tab).

by joseph moore

Ok. My gut feeling on this is Scenario 2 is your problem.
I bet the website is running in a different directory from WWWROOT, and the NTFS Security permissions are set so that IUSR doesn't have rights.
Shoot me a private message from the Peer Directory here on TR for any additional assistance.
Good luck!

This discussion is closed to new replies.