Friday, May 21, 2010

Windows 7 IIS 7.5 401.3 Unauthorized

Today I'm looking at IIS in Windows 7 for the first time. I made a new virtual directory and pointed it to a newly-created folder under My Documents, and then created an index.htm file containing nothing but

Hello World


In Internet Explorer on that same machine, I tried to go to http://localhost/myvirdir and got an error:

HTTP Error 401.3 - Unauthorized

You do not have permission to view this directory or page because of the access control list (ACL) configuration or encryption settings for this resource on the Web server.

Okay, permissions. My fault for not pointing my virtual directory to a folder under c:\inetpub\wwwroot, I figure. But I wanted to make it work with a folder under My Documents, so I'll REALLY know what exact permissions are required.

I tried sharing to folder with different combinations of specific users. Here's what didn't work:

-- just NETWORK SERVICE
-- just IIS_IUSRS
-- just DefaultAppPool
-- just SYSTEM
-- combinations of those

"Everyone" worked, but that's no answer.

Finally I found a website suggesting IIS_IUSRS plus Authenticated Users. That worked.

In fact, Authenticated Users all by itself worked, too. For now, I'm sticking with that. It bothers me that I don't know what particular authenticated user needs access. Also, that I haven't found a way, even through Manage Local Users and Groups, to see a list of all the built-in users and groups in Windows 7.

Oh, I did try looking at c:\inetpub\wwwroot and copying the share permissions that were visible for that folder -- but duplicating that didn't work either.

Authenticated Users seems safe enough. Whatever.