iisasp-classic

iis 8.5, how to set visitor permission only on current site?

the www_root folder, i set the full access permission with these user / user group:

the site in iis, basic settings, connect as -> 'iis AppPool\DefaultAppPool'

the site in iis, authentication, Anonymous authentication, enable, edit -> 'Application pool identity'

the AppPool of site using: DefaultAppPool, Advanced Settings, Identity -> 'ApplicationPoolIdentity'

now the site can not launch with error: '500 Internal Server Error'

all i want is when user visit site, the visitor can only reach the contents of current site, but can not reach the contents of other folder (by the script funciton in site), thank you.

---------------------update------------------ enter image description here here is the screenshot of error screen.

Solution

  • After many attempts, i fixed the problem by change:

    the site in iis, basic settings, connect as -> 'iis AppPool\DefaultAppPool'

    to

    the site in iis, basic settings, connect as -> Application user (pass-through authentication)

    then the site works, and fso.FileExists(Server.MapPath("../test.txt")) return false in below folder structure (which means the visitor can only reach the contents of current site):

    d:\
  |_www_root
      |_ default.asp (contains function of fso.FileExists(Server.MapPath("../test.txt")))
  |_test.txt

    ----------------- for site with access database-----------------

    you have to set 'iis AppPool\DefaultAppPool' account to 'c:\windows\temp' folder with read AND write permission, otherwise it will occur error of 'Microsoft Access Database Engine 80004005'

    ---------------------------for iis+php site-------------------------

    you have to set same full access permission with below user / users group as site folder for the folder contain php.exe:

    - administrators
- system
- iis AppPool\DefaultAppPool