Re: Having ASPNET member of Administrators

From: Matt Berther (mberther_at_hotmail.com)
Date: 01/28/05 

Date: Fri, 28 Jan 2005 13:12:12 -0800

Hello Kevin,

> The principle of least privilege. Where did you find that?

http://c2.com/cgi/wiki?PrincipleOfLeastPrivilege

> If it were always a bad idea to run ASP.Net under the System account,
> Microsoft wouldn't have bothered to make that option available. Making
> the ASP.Net account a Network Admin has much the same effect. I agree,
> he's painting with a broad brush, but the objective is to prevent
> spills, not to paint with the smallest brush possible.

I agree, to a point. Typically people try to cover up the root problem by
throwing more permissions at it. I wrote a post about this early last year
(http://www.mattberther.com/2004/04/000463.html). 

--
Matt Berther
http://www.mattberther.com