domain / basic authentication

I have a little issue that I'd like to find a fix for. A have a web server
that is a member of a development domain (yes, I know that having web
servers being members of domains isn't generally a good idea).

I have a web site on this server that is set to use basic authentication.
I've created a local user account on this server for this basic
authentication.

Developers access this server remotely using terminal services. They log in
using a domain account that is a member of the local administrator group in
order for them to make changes to this machine.

They have discovered that if they type domain\accountname and the
appropriate password they can access the website that uses basic
authentication without using the local account I created.

I can't think of any way of preventing this short of removing them as local
administrators which I don't really want to do.

Does any have any other suggestions?

Thanks for your help

Scott

Tom
Wed Jul 30 09:10:57 CDT 2003

"scott" <scotth@poulternet.com> wrote in message
news:uPA%23pDqVDHA.2488@TK2MSFTNGP09.phx.gbl...
> I have a little issue that I'd like to find a fix for. A have a web
server
> that is a member of a development domain (yes, I know that having web
> servers being members of domains isn't generally a good idea).
>
> I have a web site on this server that is set to use basic authentication.
> I've created a local user account on this server for this basic
> authentication.
>
> Developers access this server remotely using terminal services. They log
in
> using a domain account that is a member of the local administrator group
in
> order for them to make changes to this machine.
>
> They have discovered that if they type domain\accountname and the
> appropriate password they can access the website that uses basic
> authentication without using the local account I created.
>
> I can't think of any way of preventing this short of removing them as
local
> administrators which I don't really want to do.
>
> Does any have any other suggestions?

You could explicitly deny their domain accounts on the NTFS permissions on
the content, but then I don't know how they'd be able to author/develop.

Isn't this really a management issue? Follow the rules or get your fingers
whacked ...

--
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/