CODEWITHSUNDEEP
asp.netsecuritywindows-server-2008file-permissions
Xaqron
Xaqron

Reputation: 30877

Why "NETWORK SERVICE" doesn't have permission on "C:\inetpub\wwwroot" by default?

I grant permission to NETWORK SERVICE manually to have access to C:\inetpub\wwwroot so ASP.NET can do something like reading and writing local files.

Is there a security reason this permission has not been granted by default ?

Upvotes: 0

Views: 4055

Answers (3)

Ta01
Ta01

Reputation: 31630

Per this article on MSDN:

The Network Service account has Read and Execute permissions on the IIS server root folder by default. The IIS server root folder is named Wwwroot. This means that an ASP.NET application deployed inside the root folder already has Read and Execute permissions to its application folders. However, if your ASP.NET application needs to use files or folders in other locations, you must specifically enable access.

Upvotes: 2

Oded
Oded

Reputation: 499272

It is due to the principle of defence in depth - not giving permissions unless explicitly granted.

Such defaults make for a more secure IIS and operating system.

Several years ago Microsoft went through a very large push towards securing windows by default - this setting is part of that push.

Upvotes: 2

Felice Pollano
Felice Pollano

Reputation: 33272

usually on the web server just few folders are allowed to write to avoid potential security holes.

Upvotes: 1

Related Questions