Re: Domain-based IUSR and IWAM accounts

From: Jeff Cochran (jeff.nospam_at_zina.com)
Date: 09/28/05 

Date: Wed, 28 Sep 2005 16:03:10 GMT

On Tue, 27 Sep 2005 13:03:02 -0700, "Hiro"
<Hiro@discussions.microsoft.com> wrote:

>Do you have links to sites that cover all the procedures to move the IWAM
>(IIS 6.0) account to a domain controller?

I haven't seen any docuemntation on doing this, but basically, you
create a domain account and set the IIS servers to use that account.
If IIS is installed on a domain controller, the IUSR/IWAM accounts
will automatically be domain accounts since there are no local
accounts on a DC.

Jeff

>"Tom Kaminski [MVP]" wrote:
>
>> "Steve" <Steve@discussions.microsoft.com> wrote in message
>> news:B6C16AAB-48EC-4DF9-98F5-C170330B73EB@microsoft.com...
>> > We have multiple IIS servers throughout our domain. We are constantly
>> > running into the issue where the GPO overwrites the local account setting,
>> > which is default by design.
>> >
>> > MS Article 275167 states 3 resolutions.
>> > Option one is to run iisreset, which our OPS dept is tired of.
>> >
>> > Option two is not to run the GPO from the root, something our Engineering
>> > team doesn't like.
>> >
>> > Option three is to create domain based IWAM and IUSR accounts and setting
>> > permissions on each IIS server to the domain accounts.
>> >
>> > Are there any known issues with doing this?
>> > Thanks in advance,
>> > Steve
>>
>> I use domain accounts for these and have not run into any issues.
>>
>> --
>> Tom Kaminski IIS MVP
>> http://www.microsoft.com/windowsserver2003/community/centers/iis/
>> http://mvp.support.microsoft.com/
>> http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
>>
>>
>>

Relevant Pages

  • Re: IIS on a domain controller
    ... > We have a w2003 domain controller which also has IIS ans WSUS on it. ... > there any security implications with this setup or do you think it's ... Having the domain controller run your IIS takes away all sorts of ability to ... on a DC there are NO local accounts... ...
    (microsoft.public.inetserver.iis.security)
  • Re: Changing Local Admin passwords from server ASAP
    ... when I navigate to my workstation from the SBS manage computer mmc and view ... the local users, it's definitely my workstation's local accounts I'm seeing, ... admin rights without increasing their rights elsewhere on the network. ... While certain domain accounts may have ...
    (microsoft.public.windows.server.sbs)
  • Re: It must be simple, but...
    ... Why did you create domain accounts on the server and local accounts on the ... If you MUST share your client drives, ...
    (microsoft.public.windows.server.sbs)
  • Re: Local Group Policy - User Logoff Scripts
    ... What mode are you using in Loopback Processing? ... server and ran the Group Policy Results Wizard from the Group Policy ... I did find a few domain accounts for which the logoff ...
    (microsoft.public.windows.server.general)
  • Re: Permission on share folder xp pro
    ... You are correct that you cannot assign share permissions to anyone other ... What you need to do is set up accounts on the machine for each user who ... you need a winNT4 server or Win2k server to do this. ... also 'central' domain accounts. ...
    (microsoft.public.windowsxp.security_admin)