How to Set NTFS permissions on the IIS server

From previous knowledge, we learned to enable only the Web service extensions necessary for websites and application software running in your IIS server environment, by streamlining the server features to the maximum extent, this reduces the attack surface of each IIS server and enhances security.

Windows Server 2003 checks the NTFS file system's permissions to determine the type of access permissions a user or process has for a specific file or folder.

You should assign NTFS permissions to allow or deny access to sites on the IIS server in three environments defined in this Guide.

NTFS access permissions should be used together with Web access permissions, rather than replacing Web permissions. The NTFS permission only affects accounts that are allowed or denied access to site and application content. The Web permission affects all users who access the site or application. If the site permission conflicts with the NTFS permission on a folder or directory, a more restrictive setting will take effect.

For websites and applications that do not allow anonymous access, access to anonymous accounts will be explicitly rejected. When a user without authentication accesses system resources, the user is anonymous. Anonymous accounts include built-in "Guest" accounts, "Guests" groups, and "IIS Anonymous" accounts. Besides the IIS administrator, all write permissions should be cleared for all other users.

The following table provides suggestions on NTFS permissions. These permissions are applied to different file types on the IIS server. Different file types can be organized in different folders to simplify the process of applying NTFS permissions.

NTFS permission

NTFS permission recommended for file types
CGI File .exe,. dll,. cmd,. pl)
Run Everyone)
Full Control of Administrators)
Fully controlled by System)

Script file (. asp)
Run Everyone)
Full Control of Administrators)
Fully controlled by System)

Include File .inc0000.shtm0000.shtml)
Run Everyone)
Full Control of Administrators)
Fully controlled by System)

Static content .txt0000.gifini.jpg0000.htm0000.html)
Everyone read-only)
Full Control of Administrators)
Fully controlled by System)

Let's talk about setting NTFS permissions on the IIS server.