Re: 2003 Server / Application Pools - Process Isolation / FrontPage Extensions

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 05/22/04 

Date: Fri, 21 May 2004 22:52:49 -0700

Of the four principals you have mentioned
System is the local system, the highest account
used by the OS itself.
Network is a placeholder representing any account
that has logged on over the network
Interactive is a placeholder representing any account
that has logged on locally
Groups like OWS_bunchofnumnbers_admin are generated
to matches the roles that are in use per web. These can
be shut off with use of the NoMachineGroups reg key in
the Web Server Extensions key but doing so means that you
will be responsible for some permissioning tasks that the
extension would otherwise attempt to accomplish for you.

For specific responses you may wish to try the newsgroup
microsoft.public.sharepoint.windowsservices, or teamservices
in addition to the frontpage.extension group to which you did
post this. 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"someoneelse" <iheard@you.com> wrote in message
news:uNJN$RqPEHA.640@TK2MSFTNGP12.phx.gbl...
> Hi All
>
> I am wondering about FrontPage extensions and Process Isolation in Windows
> 2003 Server.
>
> I have successfully set up a site and added it to an application pool with
a
> custom user (for ASPNET).
> I also add a custom account for the IUSR process and add only the users I
> want to the site's directory via NTFS.
>
> When I add FrontPage extensions to the site, two things happened that are
> the point of my question:
>
> 1-The site is added to the MSSharePointAppPool (I imagine this is for
making
> calls to the dll in the bin).
> 2-4 users are added to the NTFS permissions in the site dir.
>
> -INTERACTIVE
> -NETWORK
> -OWS_bunchofnumnbers_admin
> -SYSTEM
>
> What are the four users for? Can I isolate them?
>
> Is there any concern about adding the site to another application pool? I
> spent a long time learning to isolate it and would hate to mess up my
work.
>
> Does this second application pool only fire for requests to the bin? It
> seems to. When I call the site and check my processes, the site is still
> running under the account I set for the first pool.
>
> Are there any links to an msdn article, that offers a further description,
> on these four new accounts and what they are used for?
>
> Thanks for any responses.
>
>

Relevant Pages

  • Re: Incoming E-Mail - cant create contact in OU
    ... central admin pool different than the web app. ... that account a little (if the web app is compromised or something, ... So I started with giving the app pool account domain admins permissions then ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Incoming E-Mail - cant create contact in OU
    ... already have the application pool delegated rights to the OU. ... In my experience it is because you didn't quite delegate enough rights to ... the account in the OU. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Incoming E-Mail - cant create contact in OU
    ... I too am worried about giving the app pool (and remember, ... local admin rights to the server hosting incoming email. ... If your app pool account is also the farm account, ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: 2003 Server / Application Pools - Process Isolation / FrontPage Extensions
    ... The nomachinegroups key is definitly part of what I was after. ... > Network is a placeholder representing any account ... >> I am wondering about FrontPage extensions and Process Isolation in Windows ... >> Is there any concern about adding the site to another application pool? ...
    (microsoft.public.windows.server.setup)
  • Re: 2003 Server / Application Pools - Process Isolation / FrontPage Extensions
    ... The nomachinegroups key is definitly part of what I was after. ... > Network is a placeholder representing any account ... >> I am wondering about FrontPage extensions and Process Isolation in Windows ... >> Is there any concern about adding the site to another application pool? ...
    (microsoft.public.frontpage.extensions.windowsnt)