Default permissions and user rights for IIS 6.0


This article describes the default permissions and the user rights on a newly installed application server that has Internet Information Services (IIS) 6.0 installed.

More Information

The following tables document the NTFS file system permissions, registry permissions, and Microsoft Windows user rights. This information applies if Microsoft ASP.NET is included as part of the installation suite. This article focuses on the World Wide Web Publishing Service and does not consider other components, such as the File Transfer Protocol (FTP) service, the Simple Mail Transfer Protocol (SMTP) service, and Microsoft FrontPage Server Extensions (FPSE).

Note For the purposes of this document, the IUSR_MachineName account is used interchangeably with a configured anonymous account.

NTFS permissions

%windir%\help\iishelp\commonAdministratorsFull control
%windir%\help\iishelp\commonSystemFull control
%windir%\help\iishelp\commonIIS_WPGRead, execute
%windir%\help\iishelp\commonUsers (See Note 1.)Read, execute
%windir%\IIS Temporary Compressed FilesAdministratorsFull control
%windir%\IIS Temporary Compressed FilesSystemFull control
%windir%\IIS Temporary Compressed FilesIIS_WPGFull control
%windir%\IIS Temporary Compressed FilesCreator ownerFull control
%windir%\system32\inetsrvAdministratorsFull control
%windir%\system32\inetsrvSystemFull control
%windir%\system32\inetsrvUsersRead, execute
%windir%\system32\inetsrv\*.vbsAdministratorsFull control
%windir%\system32\inetsrv\ASP compiled templatesAdministratorsFull control
%windir%\system32\inetsrv\ASP compiled templatesIIS_WPGFull control
%windir%\system32\inetsrv\HistoryAdministratorsFull control
%windir%\system32\inetsrv\HistorySystemFull control
%windir%\system32\LogfilesAdministratorsFull control
%windir%\system32\inetsrv\metabackAdministratorsFull control
%windir%\system32\inetsrv\metabackSystemFull control
Inetpub\AdminscriptsAdministratorsFull control
Inetpub\wwwroot (or content directories)AdministratorsFull control
Inetpub\wwwroot (or content directories)SystemFull control
Inetpub\wwwroot (or content directories)IIS_WPGRead, execute
Inetpub\wwwroot (or content directories)IUSR_MachineNameRead, execute
Inetpub\wwwroot (or content directories)ASPNET (See Note 2.) Read, execute
Note 1 You must have permissions to this directory when you use Basic authentication or Integrated authentication and when custom errors are configured. For example, when error 401.1 occurs, the logged-on user sees the expected detailed custom error only if permissions to read the 4011.htm file have been granted to that user.

Note 2 By default, ASP.NET is used as the ASP.NET process identity in IIS 5.0 isolation mode. If ASP.NET is switched to IIS 5.0 isolation mode, ASP.NET must have access to the content areas. ASP.NET process isolation is detailed in IIS Help. For additional information, visit the following Microsoft Web site:

ASP.NET process isolation

Registry permissions

HKLM\System\CurrentControlSet\Services\ASPAdministratorsFull control
HKLM\System\CurrentControlSet\Services\ASPSystemFull control
HKLM\System\CurrentControlSet\Services\HTTPAdministratorsFull control
HKLM\System\CurrentControlSet\Services\HTTPSystemFull control
HKLM\System\CurrentControlSet\Services\IISAdminAdministratorsFull control
HKLM\System\CurrentControlSet\Services\IISAdminSystemFull control
HKLM\System\CurrentControlSet\Services\w3svcAdministratorsFull control
HKLM\System\CurrentControlSet\Services\w3svcSystemFull control

Windows user rights

Access this computer from the networkAdministrators
Access this computer from the networkASPNET
Access this computer from the networkIUSR_MachineName
Access this computer from the networkIWAM_MachineName
Access this computer from the networkUsers
Adjust memory quotas for a processAdministrators
Adjust memory quotas for a processIWAM_MachineName
Adjust memory quotas for a processLocal service
Adjust memory quotas for a processNetwork service
Bypass traverse checkingIIS_WPG
Allow log on locally (see Note)Administrators
Allow log on locally (see Note)IUSR_MachineName
Deny logon locallyASPNET
Impersonate a client after authenticationAdministrators
Impersonate a client after authenticationASPNET
Impersonate a client after authenticationIIS_WPG
Impersonate a client after authenticationService
Log on as a batch jobASPNET
Log on as a batch jobIIS_WPG
Log on as a batch jobIUSR_MachineName
Log on as a batch jobIWAM_MachineName
Log on as a batch jobLocal service
Logon as a serviceASPNET
Logon as a serviceNetwork service
Replace a process level tokenIWAM_MachineName
Replace a process level tokenLocal service
Replace a process level tokenNetwork service
Note In a new default installation of Microsoft Windows Server 2003 with IIS 6.0, the Users group and the Everyone group have Bypass traverse checking permissions. The worker process identity inherits Bypass traverse checking permissions through one of these groups. If both groups are removed from Bypass traverse checking permissions, and the worker process identity does not inherit Bypass traverse checking permissions through any other assignment, the worker process does not start. If the Users group and the Everyone group must be removed from the Bypass traverse checking permissions, add the IIS_WPG group to permit IIS to function as expected.

Note In IIS 6.0, when Basic authentication is configured as one of the authentication options, the LogonMethod metabase property for Basic authentication is NETWORK_CLEARTEXT. The NETWORK_CLEARTEXT logon type does not require the Allow log on locally user right. This also applies to Anonymous authentication. For additional information, see the "Basic Authentication Default Logon Type" topic in IIS Help. You can also visit the following Microsoft Web site:

Basic authentication


For more information about how to implement and manage IIS security, visit the following Microsoft Web sites:

Windows Server 2003 Security Guide TechNetImproving Web application security: threats and countermeasures