Granting access to an IUSR_*** account on a network share

[sgs521]

I'm trying to grant permission for the IUSR_XXX account on a server to have access to a network share. Since the IUSR is a local account on the server, I'm not sure how to go about adding the permissions to the share. Trying to add the permission directly from the Share is not working since it is looking in AD for the user account and not at the local accounts on the server. Is there a way to bring the Local IUSR_XXX account into AD so that it can be added to a network share?
Any info would be greatly appreciated.

 

[TechyMcSe2k]

When doing the lookup for the account, try changing the Location to just the server and not the domain. Then if you leave the search field blank and click find; it should pull up all local accounts available for permissions to shares.

 

[sgs521]

I guess I may have missed a piece of information in the previous post, the network share is not on the same server as the computer whose local user I want to add.

Example - Network share is on \\serverX
IUSR_ServerY is the Anonymous account for IIS on ServerY

I need IUSR_ServerY to be able to read/write files to \\serverX\share

the only method I can think of is to grant read/write permission for ServerY to \\serverX\share
This I'd think should allow all local user accounts on ServerY to have read/write access to that share. Not that I necessarily want all local user accounts to have that access, but the likelyhood of anyone abusing that access is pretty slim.

 

[ScottCr]

The IUSR_XXXX account is purely the account used for anonymous access to IIS.
I would therefore create a new domain account with limited rights and permission on \\serverx\share.
Go to IIS and configure it to use your new domain account for anonymous connections. Make sure the domain account has the relevant permissions over the folders your website is stored.

http://scottcross.blogspot.com

Windows and NT Admin.

 

[sgs521]

Ah, that's something I definitely had not thought of. Since the IIS server that this is on is not a production server, changing the anonymous user shouldn't have any major impact at all. Thanks for the tip, I'll definitely be trying that.