IIS guest account - Is this a bad idea?

M

mancombseepgood

Executive Member
Joined
Jun 1, 2004
Messages
9,351
Reaction score
2
Location
.
is this a bad idea:
Making the internet guest account a member of the local administrators group?

If yes, could you be specific as to why?

Also, what about if the PC is not connected to the net?
 
Indeed a bad idea. You don't want to give every single oak admin privileges. You would always know how needs admin rights thus you can give that person the relevant permissions.

Even if the PC is not connected to the net. You never give admin rights to a guest account. Rather create an account for the specific person that needs the admin rights.
 
We're talking about the internet guest account (IUSR_xxx), not the regular guest account...
 
Giving admin rights to a guest account in general is just wrong. The guest account should be disabled. Create another account and give it whatever permissions it needs.
 
chiskop said:
Which part are you asking: IIS or guest account? :)
Click to expand...

The Internet Guest account (IUSR_computername)

Right click my computer, manage, local users and groups, users - you will see it there.

It's the guest account used by IIS for anon access to your web pages. Giving it local file access shouldnt' affect web users, but I stand to be corrected.
 
it is a bad idea.

any vulnerability in your server software could lead to direct local administrator access, without the need for any privilege escalation.

with the amount of cross site scripting errors and other http vulnerabilities it is a bad idea.

any scripts you run on the site will run as a local administrator, a bad idea.
I mean, you wuouldnt want me to be able to delete boot.ini just because you forgot to do data validation on an input form?
 
Renamed20070410 said:
it is a bad idea.

any vulnerability in your server software could lead to direct local administrator access, without the need for any privilege escalation.

with the amount of cross site scripting errors and other http vulnerabilities it is a bad idea.

any scripts you run on the site will run as a local administrator, a bad idea.
I mean, you wuouldnt want me to be able to delete boot.ini just because you forgot to do data validation on an input form?
Click to expand...

Good point, that's the kind of answer I was looking for - thanks renamed...
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X