If I setup a website in IIS 6 with WebDAV enabled and give the
IUSR_{machine.name} account no permissions (not sure what happens if i
explictly deny) to the root of the directory, why can I successfully
issue an HTTP PUT command in the root of the directory. When I check
the ownership of the file, it lists the IUSR_{machine.name} account,
even though it shouldn't have had permissions to do so.
Of course I can uncheck the "Write" box in the IIS properties to
disallow the PUT commands, but I was under the impression that the
most prohibitive of the two permissions (Web and NTFS) would prevail.
In this case, NTFS gives no access to the IUSR_{machine.name} account
so, in my opinion, it shouldn't be able to write. Anonymous access is
enabled in IIS.
-pk
FAQ
Search
Profile
Private Messages
Log in
