Understanding Built-In User and Group Accounts in IIS 7
Understanding Built-In User and Group Accounts in IIS 7
By lzb
October 19, 2018
Introduction
In earlier versions of IIS, a local account called IUSR_MachineName is created during installation. IIS used the IUSR_MachineName account by default whenever anonymous authentication was enabled. This was used by both the FTP and HTTP services.
There was also a group called IIS_WPG, which was used as a container for all the application pool identities. During IIS setup, all the appropriate resources on the system were granted the correct user rights for the IIS_WPG group so that an administrator only needed to add their identity to that group when they created a new application pool account.
This model worked well, but had its drawbacks: the IUSR_MachineName account and the IIS_WPG group were both local to the system that they were created on. Every account and group within Windows is given a unique number called a security identifier (SID) that distinguishes it from other accounts. When an ACL is created only the SID is used. As part of the design in earlier versions of IIS, IUSR_MachineName was included in the metabase.xml file so that if you tried to copy the metabase.xml from one computer to another, it would not work. The account on the other computer would have a different name.
In addition, you could not 'xcopy /o' ACLs from one computer to another since the SIDs were different from computer to computer. One workaround was to use domain accounts, but that required adding an active directory to the infrastructure. The IIS_WPG group had similar issues with user rights. If you set ACLs on one computer's file system for IIS_WPG and tried to 'xcopy /o' those over to another computer, it would fail. This experience has been improved in IIS 7 and above by using a built-in account and group.
A built-in account and group are guaranteed by the operating system to always have a unique SID. IIS 7 and above have taken this further and ensured that the actual names that are used by the new account and group will never be localized. For example, regardless of the language of Windows that you install, the IIS account name will always be IUSR and the group name will be IIS_IUSRS.
In summary, IIS 7 and above offer the following:
The IUSR built-in account replaces the IUSR_MachineName account.
The IIS_IUSRS built-in group replaces the IIS_WPG group.
The IUSR account no longer needs a password because it is a built-in account. Logically, you can think of it as being the same as the NETWORKSERVICE or LOCALSERVICE accounts. Both the new IUSR account and the IIS_IUSRS group are discussed in greater depth in the sections below.
Understanding the New IUSR Account
The IUSR account replaces the IUSR_MachineName account in IIS 7 and above. The IUSR_MachineName account will still be created and used if you install the FTP 6 compatible server that is included in Windows Server 2008. If you do not install the FTP server that is included with Windows Server 2008, then this account will not be created.
This built-in account does not need a password and will be the default identity that is used when anonymous authentication is enabled. If you look in the applicationHost.config file you will see the following definition:
<anonymousAuthentication enabled="true" userName="IUSR" defaultLogonDomain="" />
This tells IIS to use the new built-in account for all anonymous authentication requests. The biggest advantages are that you can:
Set file system permissions for the IUSR account by using Windows Explorer or any of the many command line tools.
No longer need to worry about passwords expiring for this account.
Use xcopy /o to copy files along with their ownership and ACL information to different computers seamlessly.
Note: The IUSR account is similar to LOCALSERVICE in the manner in which it acts anonymously on the network. The NETWORKSERVICE and LOCALSYSTEM accounts can act as the machine identity, but the IUSR account cannot because it would require an elevation of user rights. If you need the anonymous account to have rights on the network, you must create a new user account and set the user name and password manually, as you did in the past for anonymous authentication.
To grant an anonymous account rights on the network by using IIS Manager:
Click Start, type INetMgr.exe, and then click Enter. If prompted, click Continue to elevate your permissions.
In the Connections section, click the + button next to the name of your computer.
In IIS Manager, double-click the site that you want to administer.
In the Features View, double-click Authentication.
Select Anonymous Authentication, and then click Edit in the Actions pane.
In the Edit Anonymous Authentication Credentials dialog box, click the Specific user option, and then click Set.
In the Set Credentials dialog box, input the user name and password desired, and then click OK.
Understanding the New IIS_IUSRS Group
The IIS_IUSRS group replaces the IIS_WPG group. This built-in group has access to all the necessary file and system resources so that an account, when added to this group, can seamlessly act as an application pool identity.
As with the built-in account, this built-in group solves several xcopy deployment obstacles. If you set permissions on your files for the IIS_WPG group (that was available on IIS 6.0 systems) and tried to copy those files to another Windows computer, the group's SID would be different across the computers and your site's configurations would be broken.
Since the group SID in IIS 7 and above is the same on all systems that are running Windows Server 2008, you can use 'xcopy /o' to preserve the ACL's and ownership information as you move files from computer to computer. This makes xcopy deployments easy.
IIS 7 and above also makes the process of configuring an application pool identity and making all necessary changes easier. When IIS starts a worker process, it needs to create a token that the process will use. When this token is created, IIS automatically adds the IIS_IUSRS membership to the worker processes token at runtime. The accounts that run as 'application pool identities' no longer need to be an explicit part of the IIS_IUSRS group. This change helps you to set up your systems with fewer obstacles and makes your overall experience more favorable.
If you want to disable this feature and manually add accounts to the IIS_IUSRS group, disable this new feature by setting the manualGroupMembership value to 'true'. The following example shows how this can be done to the defaultAppPool:
<applicationPools>
<add name="DefaultAppPool">
<processModel manualGroupMembership="true" />
</add></applicationPools >
Copy From:lzb
Understanding Built-In User and Group Accounts in IIS 7的更多相关文章
- [Asp.Net]Understanding Built-In User and Group Accounts in IIS
昨天把程序IIS6迁移到IIS7,出现异常 解决办法:文件夹选项权限增加IIS_IUSER 资料来源: http://www.iis.net/learn/get-started/planning-fo ...
- mysql 5.7.17发布
Mysql 5.7.17发布了,主要修复: Changes in MySQL 5.7.17 (2016-12-12, General Availability) Compilation Notes M ...
- Fedora 22中的用户和用户组管理
The control of users and groups is a core element of Fedora system administration. This chapter expl ...
- Achieving High Availability and Scalability - ARR and NLB
Achieving High Availability and Scalability: Microsoft Application Request Routing (ARR) for IIS 7.0 ...
- 一键安装GitLab7
1. Install and configure the necessary dependencies If you install Postfix to send email please sele ...
- windows msiexec quiet静默安装及卸载msi软件包
aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAoUAAAA4CAIAAAAEgBUBAAAIj0lEQVR4nO2dQXLcOAxFdbXJ0aZys6
- Windows Access Token
security descriptor A structure and associated data that contains the security information for a sec ...
- ASP.NET IIS Registration Tool (Aspnet_regiis.exe)
IIS Version Special cases for 32-bit versions of Aspnet_regiis.exe 6.0 You can run the 32-bit versio ...
- Archlinux系统配置学习笔记(一)
本文档是有关Archlinux系统配置的学习笔记,参考和学习的是Archlinux官方网站上的相应文档:General Recommendations. 这里的配置主要是针对按照官方网站上的文档刚刚完 ...
随机推荐
- Zookeeper(一)CentOS7.5搭建Zookeeper3.4.12集群与命令行操作
一. 分布式安装部署 1.0 下载地址 官网首页: https://zookeeper.apache.org/ 下载地址: http://mirror.bit.edu.cn/apache/zookee ...
- tjoi2018
1.[TJOI2018]数学计算 傻逼题 会发现符合线段树分治的特点 每个数的操作范围都是连续的 然后就等于区间修改了 #include <bits/stdc++.h> using nam ...
- WebApi接口返回值不困惑:返回值类型详解
前言:已经有一个月没写点什么了,感觉心里空落落的.今天再来篇干货,想要学习Webapi的园友们速速动起来,跟着博主一起来学习吧.作为程序猿,我们都知道参数和返回值是编程领域不可分割的两大块,此前分享了 ...
- groovy中的正则表达式操作符【groovy】
groovy中对于正则表达式的书写进行了简化,同时引入了新的操作符,使得正则表达式使用起来比较方便简单. 对于书写的改进: 比如 assert "\\d" == /\d/ 也就是在 ...
- Coolpy网络部署说明(局域网)
本文将介绍Coolpy第一种方案的网络部署方法.以方便大家学习如何让coolpy设备部署到相应的应用场景中.本例将以水星MW310R无线路由器作为演示路由器. 1.局域网部署 即coolpy设备=&g ...
- Python_dict部分功能介绍
字典是无序的 x.clear():清除所有元素 x.fromkeys():返回一个新的字典,使前面的key=value x.get():如果k不存在,默认返回一个值,如果存在,则返回存在的值 x.it ...
- pip安装其他包报错
pip安装时报错 Unknown or unsupported command 'install 一.是否配置了路径 配置了看下面的方法. 二.有多个pip系统不知道调用哪个. 1.where pi ...
- Docker 二进制安装docker
https://blog.csdn.net/bruce_yds/article/details/80035714
- rc.local(ubuntu18.04)
系统自带服务/lib/systemd/system/rc-local.service 软连接为 /lib/systemd/system/rc.local.service -> rc-local. ...
- 055 kafka可靠性与高性能
一:可靠性 1. 二:高性能 1.