Access Control Lists
Applies To: Windows Server 2003, Windows Server 2003 with SP1
NTFS permissions are set and managed by using access control lists (ACLs). An ACL is a list that indicates which users or groups are able to access or modify a particular file. An ACL is made up of access control entries (ACEs).
ACL Tools
Many tools, such as the cacls command and the Xcacls.exe command-line tool, are available to help you set and manage ACLs.
Cacls
Cacls is a Windows Server 2003 command that allows you to display or modify discretionary access control lists (DACLs). For more information about the cacls command, see Cacls in Help and Support Center for Windows Server 2003.
Xcacls.exe
Xcacls.exe is a Windows Server 2003 command-line tool that you can use to set all file-system security options that are accessible in Windows Explorer from the command line. Xcacls.exe does this by displaying and modifying the ACLs of files. For more information, see Xcacls.exe.
Default ACLs and Privileges for the IIS_WPG Group
When you install IIS 6.0, some ACLs and privileges are set automatically for the IIS_WPG group. Table 5.8, Table 5.9, and Table 5.10 list the default ACLs that are set during the installation process.
Table 5.8 Default File System ACLs for the IIS_WPG Group
Location | Setting | Description |
---|---|---|
%windir%\Help\iishelp\common |
Read, Execute |
Access to default error page |
%windir%\IIS Temporary Compressed Files |
Full |
Access to the compression directory |
%windir%\system32\MicrosoftPassport |
Read, Execute, Write, Delete |
Passport configuration |
%windir%\inetsrv\ASP Compiled Templates |
Full |
Access to ASP compiled templates that are saved to disk |
%windir%\inetpub\wwwroot |
Read, Execute |
Access to the content root directory |
Table 5.9 Default Metabase ACLs for the IIS_WPG Group
Location | Setting | Description |
---|---|---|
/ (IIS_ROOT key) |
Read, Unsecure Read, Enumerate Keys |
Give worker process access to read metabase data |
/LM/W3SVC/AppPools |
Unsecure Read |
Give worker process access to read unsecured metabase properties |
/LM/W3SVC/Filters |
Read, Unsecure Read, Enumerate Keys, Write |
Allow IIS to update filter state |
/LM/W3SVC/X/Filters |
Read, Unsecure Read, Enumerate Keys, Write |
Allow IIS to update filter state (for new sites, where X is the Web site number) |
Table 5.10 Default Registry Key ACLs for the IIS_WPG Group
Location | Setting | Description |
---|---|---|
HKLM\System\CurrentControlSet\Services\W3SVC |
Read |
Read W3SVC configured registry keys |
HKLM\System\CurrentControlSet\Services\InetInfo |
Read |
Read InetInfo configured registry keys |
HKLM\System\CurrentControlSet\Services\HTTP |
Read |
Read HTTP configured registry keys |
HKLM\System\CurrentControlSet\Services\ASP |
Read |
Read ASP configured registry keys |
All worker process identities must be members of the IIS_WPG group. If the worker process identity account is not in the IIS_WPG group and does not have the appropriate privileges and permissions, the worker process will not start. In addition, if the worker process identity accounts are not members of the IIS_WPG group, they might not be able to launch a worker process after a modification to the operating system, such as upgrading to the next version or installing a service pack.
In addition, IIS sets restrictive ACLs on log files. For more information about log file permissions, see Analyzing Log Files.
Metabase ACLs
IIS installs the metabase files with strict ACLs set to prevent anyone but administrators from viewing your configuration data. You can use the MetaACL.vbs command-line tool to change the ACLs and grant granular permissions on a site-by-site or application-by-application basis. For more information about MetaACL.vbs, see Knowledge Base article 267904, Metaacl.exe modifying metabase permissions for IIS Admin Objects. For more information about metabase security, see Working with the Metabase.
Important
Before you edit the metabase, verify that you have a backup copy that you can restore if a problem occurs. For information about how to back up the metabase, see Working with the Metabase.