Re: Restrict use of AMI, ADSI and WScript.Shell

From: Peter Johansen (peterJohan13384_at_hotmail.com)
Date: 04/13/04 

Date: Tue, 13 Apr 2004 04:01:05 GMT

Hi David,

Thank you very much. I'm really glad it's as simple as setting NTFS
permissions on the 2 files you mentioned. Just a note - the "adsiis.dll" was
in the "%windir%\system32\inetserv" folder on my server, not the
"%windir%\system32" folder. Not sure if different Windows versions has the
file in different places but thought I should mention it in case someone
else ever has the same Q's. I assume it's the same file though.

If anyone has any suggestions as to what other dangerous objects should be
restricted in this manner I would appreciate it. The one possible security
risk I will have to allow unfortunately is access to the FSO, but I think I
have that locked down fairly well since I'm using different IUSR's and app
pool identities for each web site, with appropriate NTFS permissions set on
the web root and contents.

Thanks!

"David Wang [Msft]" <someone@online.microsoft.com> wrote in message
news:ufc1RcQIEHA.4092@TK2MSFTNGP11.phx.gbl...
> You can use Filesystem ACL on %windir%\System32\wshom.ocx to control who
> can create the WScript.Shell object (as well as all the WScript.* objects)
> in one shot. Can't use Filesystem ACL to allow one users to create
> WScript.Network but not WScript.Shell, for example.
>
> I'm not certain if ADSI has anything comparable to WMI, but you can use
the
> same Filesystem ACL approach on %windir%\system32\adsiis.dll to prevent
> users to access all of the IIS:// ADSI namespace.
>
> --
> //David
> IIS
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "Peter Johansen" <peterJohan13384@hotmail.com> wrote in message
> news:ZFFec.132167$Bk31.35595@twister01.bloor.is.net.cable.rogers.com...
> Hi, I would appreciate any tips on restricting WMI, ADSI, and
WScript.Shell
> from being used in ASP pages by anyone other than the Administrators group
> in a shared hosting environment. WMI seems like it can be restricted
fairly
> easily via the "WMI Control" MMC snap-in. But how about ADSI and
> WScript.Shell? This is for IIS 6.0 on W2K3.
>
> By the way, each web site has it's own IUSR account and application pool.
> The application pool's identity is also a unique user account for each
web.
> This allows me to restrict access to files between different webs.
However,
> I would still like to restrict WMI, ADSI and Wscript.Shell from being used
> at all, except by the Administrators group.
>
> Thanks for any tips and advice.
>
>
>
>
>

Relevant Pages

  • Re: Sharepoint Security - Help!!!!!
    ... When they did the migration from one server to another it went from Standard ... differnt sharepoint document libraries that we have in our internal company ... permissions as to who could look in them. ... > How can I restrict access and double check that it isn't some other option. ...
    (microsoft.public.windows.server.sbs)
  • Re: Restricted Shells or Menu Based Shells
    ... > If you remove my permissions to a file I just upload my own file and use ... However, one need not restrict your use of your home directory, other ... owned by the untrusted group, ...
    (Focus-Linux)
  • Re: Limit user access to server
    ... to the Remote Desktop users group and make sure that group has the user ... >> needs then create your own local group and configure ntfs permissions ... For XP Pro and Windows 2003 Software Restriction ... >> Policies can also be used to restrict what applications a user can ...
    (microsoft.public.security)
  • Re: Policies w/o logging into Domain
    ... I would think it would be better to restrict this using a firewall or ... is has local admin permissions on the workstation can remove the permissions ... gateway information either from DHCP or from their IP settings. ... In order to restrict ...
    (microsoft.public.win2000.security)
  • Re: db_owner - Unauthorized Size increase
    ... permissions will suffice? ... > Kevin Connell, MCDBA ... >> How can i restrict the maximum size of the database for a db_owner? ...
    (microsoft.public.sqlserver.security)