IIS 6 and ACL entries

From: Tim Berk (TimBerk_at_discussions.microsoft.com)
Date: 03/17/05 

Date: Thu, 17 Mar 2005 12:51:04 -0800

Hello all,

I am having a problem with IIS 6 and ACL's. I have a webDAV folder setup
with windows integrated and digest authentication. I am trying to tighten
down the security so that only a few users can access this folder. I have 2
user accounts which are able to access the folder with the correct level of
permission. I have some other user accounts with the exact same permissions
(I have checked and rechecked this repeatedly) and group membership and they
are unable to access this folder. They recieve a "HTTP Error 401.3 -
Unauthorized: Access is denied due to an ACL set on the requested resource",
which is not the case. I can actually copy one of the working user accounts
and it won't access the folder. THe content is hosted on a remote file
server. I have the delegation of credentials set properly. I have enabled
auditing on the file server where the folder resides and the audit log shows
entries when the working user accounts are used, but nothing when one of the
non-working user accounts is used. No success, no Failure, no anything, as if
the request never made it to the file server. In the security log of the
domain controller, both the "good_user" and the "bad_user" are recording
successful account log on events, so it is not an authentication issue. In
the web server log, all the requests are logged with some differences. A
successful request looks something like this:

2005-03-17 00:28:42 xxx.xxx.xx.xxx GET /windyriver/ - 80 DOMAIN\good_user
xxx.xxx.xx.xxx
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322)
200 0 0

An unsucessful request looks something like this:

2005-03-17 02:06:15 xxx.xxx.xx.xxx GET /windyriver - 80 DOMAIN\bad_user
xxx.xxx.xx.xxx Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) 401 3 5

THe difference seems to be the trailing slash '/' after the GET request, but
I am not sure what to make of that. I have tried this from outside the
firewall, inside from the LAN and from the console of the web server (by
right-clicking the virtual directory and selecting "browse") and I get the
same results every time. My question is why is the web server not using the
entries from the ACL consistently? Why is there no entry for a failed request
in the audit log of the file server? What am I missing here?

Thanks in advance!

tb

Relevant Pages

  • Re: IIS 6 and ACL entries
    ... > down the security so that only a few users can access this folder. ... I have some other user accounts with the exact same ... > auditing on the file server where the folder resides and the audit log ... > the request never made it to the file server. ...
    (microsoft.public.inetserver.iis)
  • Re: Win 2003 Domain & setting up users on a client, (Win XP pro)
    ... however do i not ned to set up a folder and a share drive and a w2k profile ... i couldnt see my home drive on the server, do i need to write a log on script ... > 1) You need to have the client join the domain, ... > 2) Create user accounts on the Domain Controller. ...
    (microsoft.public.windowsxp.general)
  • Re: Permissions problem
    ... Windows Small Business Server 2008 Unleashed ... A Microsoft Registered Partner ... I have two user accounts and 2 computers. ... able to access the folder without any problem. ...
    (microsoft.public.windows.server.sbs)
  • Re: Auditing Object Access
    ... If the users have a domain user account, which i assume, because they use RDP to connect to the server, then open the folder properties where the data is stored, go to Security Tab and enable auditing on the folder, choose the user accounts or better create a group, move all user accounts to the group and add the group for auditing. ... using a DC for normal user logons as a Terminal server is a really bad decision from the point of security. ...
    (microsoft.public.windows.server.general)
  • Web client and FTP
    ... FTP setup on 2K Server. ... List Folder for these two accounts). ... Deny Write to the above user accounts! ...
    (microsoft.public.inetserver.iis.security)
Quantcast