How to set minimum NTFS permissions and user rights for IIS 5.x or IIS 6.0

To do this, follow these steps:

1. Open Windows Explorer. To do this, click Start, click Programs, and then click
   Windows Explorer.
2. Expand My Computer.
3. Right-click the system drive (this is typically drive C), and then click Properties.
4. Click the Security tab, and then click Advanced to open the Access Control Settings for Local Disk dialog box.
5. Click the Owner tab, click to select the Replace Owner on Sub containers and Objects check box, and then click Apply.
   
   If you receive the following error message, click Continue:
   An error has occurred applying security information to %systemdrive%\Pagefile.sys
6. If you receive the following error message, click Yes:
   You do not have permission to read the contents of directory %systemdrive%\System Volume Information - Do you want to replace the directory permission - All permission will be replaced granting you Full Control
7. Click OK to close the dialog box.
8. Click Add.
9. Add the following users, and then grant them the Full Control NTFS permission:
   • Administrator
   • System
   • Creator Owner
10. After you have added these NTFS permissions, click Advanced, click to select the Reset permission on all child objects and enable propagation of inheritable permissions check box, and then click Apply.
11. If you receive the following error message, click Continue:
    An error has occurred applying security information to %systemdrive%\Pagefile.sys
12. After you have reset NTFS permissions, click OK.
13. Click the Everyone group, click Remove, and then click OK.
14. Open the properties for the %systemdrive%\Program Files\Common Files folder, and then click the Security tab. Add the account that is used for anonymous access. By default, this is the IUSR_<MachineName> account. Then, add the Users group. Make sure that only the following are selected:
    • Read & Execute
    • List Folder Contents
    • Read
15. Open the properties for the root directory that holds your Web content. By default, this is the %systemdrive%\Inetpub\Wwwroot folder. Click the Security tab, add the IUSR_<MachineName> account and the Users group, and then make sure that only the following are selected:
    • Read & Execute
    • List Folder Contents
    • Read
16. If you want to grant Write NTFS permission for Inetpub\FTProot or the directory path for your FTP site or sites, repeat step 15.
    
    Note We do not recommend that you grant NTFS Write permissions to the anonymous account in any directories, including directories used by the FTP service uses. This can cause unnecessary data to be uploaded to your Web server.

To do this, follow these steps:

1. In the %systemroot%\System32 folder, select all folders except the following:
   • Inetsrv
   • Certsrv (if present)
   • COM
2. Right-click the remaining folders, click Properties, and then click the Security tab.
3. Click to clear the Allow inheritable permissions check box, click Copy, and then click OK.
4. In the %systemroot% folder, select all folders except the following:
   • Assembly (if present)
   • Downloaded Program Files
   • Help
   • Microsoft.NET (if present)
   • Offline Web Pages
   • System32
   • Tasks
   • Temp
   • Web
5. Right-click the remaining folders, click Properties, and then click the Security tab.
6. Click to clear the Allow inheritable permissions check box, click Copy, and then click OK.
7. Apply permissions to the following:
   1. Open the properties for the %systemroot% folder, click the Security tab, add the IUSR_<MachineName> and IWAM_<MachineName> accounts and the Users group, and then make sure that only the following are selected:
      • Read & Execute
      • List Folder Contents
      • Read
   2. Open the properties for the %systemroot%\Temp folder, select the IUSR_<MachineName> account (this account is already present because it inherits from the Winnt folder), and then click to select the Modify check box. Repeat this step for the IWAM_<MachineName> account and the
      Users group.
   3. If FrontPage Server Extension Clients such as FrontPage or Microsoft Visual InterDev are being used, open the properties for the %systemdrive%\Inetpub\Wwwroot folder, select the Authenticated Users group, select the following, and then click OK:
       
      • Modify
      • Read & Execute
      • List Folder Contents
      • Read
      • Write

The following table lists the permissions that will be applied when you follow the steps in the "Disable inheritance in system directories" section. This table is for reference only.

 To apply the permissions in the following table, follow these steps:  

1. Open Windows Explorer. To do this, click Start, click Programs, click Accessories, and then click Windows Explorer.
2. Expand My Computer.
3. Right-click %systemroot%, and then click Properties.
4. Click the Security tab, and then click Advanced.
5. Double-click Permission, and then select the appropriate setting from the Apply Onto list.

Note In the "Apply To" column, the term Default refers to "This folder, subfolders, and files."  
Note If you are using FrontPage Server Extensions, the Authenticated Users or the Users group must have the Change NTFS permission to create, to rename, to write, or to provide the functionality that a developer might have to have from a FrontPage-type of client, such as Visual InterDev 6.0 or FrontPage 2002.

1. Click Start, click Run, type regedt32, and then click OK. Do not use Registry Editor because it does not let you change permissions in Windows 2000.
2. In Registry Editor, locate and select HKEY_LOCAL_MACHINE.
3. Expand System, expand CurrentControlSet, and then expand Services.
4. Select the IISADMIN key, click Security (or press ALT+S), and then select
   Permissions (or press P).
5. Click to clear the Allow inheritable permissions from parent to propagate to this object check box, click Copy, and then remove all users except:
   • Administrators (Allow Read and Full Control)
   • System (Allow Read and Full Control)
6. Click OK.
7. Repeat the steps for the MSFTPSVC key.
8. Select the W3SVC key, click Security, and then click Permissions.
9. Click to clear the Allow inheritable permissions from parent to propagate to this object check box, and then remove all entries except:
   • Administrators (Allow Read and Full Control)
   • System (Allow Read and Full Control)
   • Network (Read)
   • Service (Read)
   • IWAM_<MachineName> (Read)
10. Click OK.

Registry

The following table lists the permissions that will be applied when you follow the steps in the "Grant permissions in the registry" section. This table is for reference only.

Note The acronym HKLM stands for HKEY_LOCAL_MACHINE.