NTFS permissions

Hi all

I'm running IIS 5.x on a stand-alone windows 2000 pro connected to the
internet with all the latest security patches installed and using Zone
Alarm Pro as firewall. Net Framework v1.03705. I have no PDC or BDC
for that matter. I have all my virtual directories on my g: partition
NOT under c:\wwwroot.

As I have some trouble with logins and other things. I have followed
the instructions Set basic NTFS Permissions for IIS 5.0 on this page
http://support.microsoft.com/default.aspx?scid=kb;EN-US;271071
but I'm a little confused.

I would be very happy to learn from ppl with above configuration and a
fully functional web server the NTFS groups/users you have placed on
the folder %systemroot%\system32\inetsrv and permissions granted. Of
course only the groups/user related to the web services. For instance
I have the following settings

Administrators - full control
Creator Owner - Have been granted full control but the checkmarks
keeps disappearing and the boxes are empty?
Internet guest account (/IUSR) - read & execute
SYSTEM - full control
Users - Read & execute
Web anonymous users - Read & execute

I would like to know the default setting for this folder. Tia

Bojidar
Sun May 09 03:48:48 CDT 2004

Mine are these and I think that they are default ones

C:\WINNT\system32>cacls inetsrv
C:\WINNT\system32\inetsrv BUILTIN\Users:R
BUILTIN\Users:(OI)(CI)(IO)(special access:)
GENERIC_READ
GENERIC_EXECUTE

BUILTIN\Power Users:C
BUILTIN\Power Users:(OI)(CI)(IO)C
BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
CREATOR OWNER:(OI)(CI)(IO)F

Kim
Sun May 09 04:10:01 CDT 2004

Hi

Thanks a lot!

Have you run the LockDown tool on your server and if you have the time
also your settings for the Inetpub\wwwroot becourse this would be the
same for all Virtual Directories, I think! Thanks




On Sun, 9 May 2004 11:48:48 +0300, "Bojidar Alexandrov"
<bojo@kodar.net> wrote:

>Mine are these and I think that they are default ones
>
>C:\WINNT\system32>cacls inetsrv
>C:\WINNT\system32\inetsrv BUILTIN\Users:R
> BUILTIN\Users:(OI)(CI)(IO)(special access:)
> GENERIC_READ
> GENERIC_EXECUTE
>
> BUILTIN\Power Users:C
> BUILTIN\Power Users:(OI)(CI)(IO)C
> BUILTIN\Administrators:F
> BUILTIN\Administrators:(OI)(CI)(IO)F
> NT AUTHORITY\SYSTEM:F
> NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
> CREATOR OWNER:(OI)(CI)(IO)F
>

Bojidar
Sun May 09 06:12:26 CDT 2004

I have'nt run LockDown but I think that it does not modify folder
permissions - only enabled services....
Mine premissions of Default Web site probbaly are not default ones.
Generally you need that IUser_xxx have read permissions and Administrators
(or FPE Authors have full permissions) here they are but have in mind
probbaly they are not optimal ones.

C:\Inetpub>cacls wwwroot

C:\Inetpub\wwwroot BOJO\Web Applications:(OI)(CI)(DENY)(special access:)
DELETE
WRITE_DAC
WRITE_OWNER
FILE_WRITE_DATA
FILE_APPEND_DATA
FILE_WRITE_EA
FILE_DELETE_CHILD
FILE_WRITE_ATTRIBUTES

BOJO\Web Anonymous Users:(OI)(CI)(DENY)(special access:)
DELETE
WRITE_DAC
WRITE_OWNER
FILE_WRITE_DATA
FILE_APPEND_DATA
FILE_WRITE_EA
FILE_DELETE_CHILD
FILE_WRITE_ATTRIBUTES

Everyone:(OI)(CI)R
NT AUTHORITY\SYSTEM:(OI)(IO)F
NT AUTHORITY\SYSTEM:(CI)F
BUILTIN\Administrators:(OI)(IO)F
BUILTIN\Administrators:(CI)F


Bojidar Alexandrov

"Kim Lots" <nomail@forme.com> wrote in message
news:clsr90h71firapldeg06ttko9p9pelgj57@4ax.com...
> Hi
>
> Thanks a lot!
>
> Have you run the LockDown tool on your server and if you have the time
> also your settings for the Inetpub\wwwroot becourse this would be the
> same for all Virtual Directories, I think! Thanks
>
>
>
>
> On Sun, 9 May 2004 11:48:48 +0300, "Bojidar Alexandrov"
> <bojo@kodar.net> wrote:
>
> >Mine are these and I think that they are default ones
> >
> >C:\WINNT\system32>cacls inetsrv
> >C:\WINNT\system32\inetsrv BUILTIN\Users:R
> > BUILTIN\Users:(OI)(CI)(IO)(special access:)
> > GENERIC_READ
> > GENERIC_EXECUTE
> >
> > BUILTIN\Power Users:C
> > BUILTIN\Power Users:(OI)(CI)(IO)C
> > BUILTIN\Administrators:F
> > BUILTIN\Administrators:(OI)(CI)(IO)F
> > NT AUTHORITY\SYSTEM:F
> > NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
> > CREATOR OWNER:(OI)(CI)(IO)F
> >
>