Run IIS as admin to write to Active Directory - security risk?

I'm looking for opinions on a particular situation. We're exploring a web
app that will allow public users to create their own user accounts, on the
fly, in Active Directory. The only way I know how to do this is to allow the
IIS process to run as local admin. Even considering that option is really
making me cringe. Does anyone have any docs from Microsoft or other
authorities on the subject that highlights this issue?

Re: Run IIS as admin to write to Active Directory - security risk?

Meaning no disrespect, but that is plain crazy !
First, running IIS with local admin will not accomplish anything
toward ability to create accounts is AD (unless the IIS is on DC).
Second, running IIS as local admin is not a good idea in itself.
Third, any AD account can be delegated the ability to define new
accounts in AD.
Finally, why would you want a public user to have an account in
your AD, or to self-define it? It sounds like an environment with
which I could have some fun if my inclination was on that side.

"Jason Shuck" wrote in message
news:9E9BE1B3-A1B7-4D45-A2F2-B0C3A400F0B2@microsoft.com...
> I'm looking for opinions on a particular situation. We're exploring a web
> app that will allow public users to create their own user accounts, on the
> fly, in Active Directory. The only way I know how to do this is to allow
> the
> IIS process to run as local admin. Even considering that option is really
> making me cringe. Does anyone have any docs from Microsoft or other
> authorities on the subject that highlights this issue?

Re: Run IIS as admin to write to Active Directory - security risk?

Jason, as PS. , to get at what seem your objectives . . .

Please reconsider using ADAM with IIS (better yet on R2 also w/. ADFS).
This can be done on standalone or member of domain, w/. or w/o identity
relationships to AD principals.
www.microsoft.com/adam
but for www microsoft.com/adfs one now still needs use links like
http://www.microsoft.com/WindowsServer2003/R2/Identity_Manag ement/ADFSwhitepaper.mspx
http://msdn.microsoft.com/theshow/episode047/default.asp

Roger

"Jason Shuck" wrote in message
news:9E9BE1B3-A1B7-4D45-A2F2-B0C3A400F0B2@microsoft.com...
> I'm looking for opinions on a particular situation. We're exploring a web
> app that will allow public users to create their own user accounts, on the
> fly, in Active Directory. The only way I know how to do this is to allow
> the
> IIS process to run as local admin. Even considering that option is really
> making me cringe. Does anyone have any docs from Microsoft or other
> authorities on the subject that highlights this issue?

Re: Run IIS

Thanks, the outside auditor's has made it a requirement for our accrediation;
If it's not supported, then I'll let them know.

Thanks.

"Ken Schaefer" wrote:

> It is not supported running them as any other user. Why do you want to do
> this?
>
> Cheers
> Ken
>
> --
> My IIS blog: http://adopenstatic.com/blog
>
> "Don Jones" wrote in message
> news:8EE7E3C2-8752-4677-AF10-9690A566BAE9@microsoft.com...
> > Is it possible to run the IIS services as a user other than the local
> > system
> > account? If so, what rights does the user need?
> >
> > Windows Server 2003 w/SP2 IIS 6.0
> >
> > Thanks.
> >
> >
>
>

Re: Run IIS

IIS Services must run as LocalSystem. Any other setting is
unsupported. So, sure, you can change it and make sure that IIS no
longer runs, so obviously you're secured and you pass the security
accreditation! ;-) No really, in all seriousness, tell the auditor
that their requirement is bogus.

With IIS6, there is really NO reason to change the IIS Services
credentials because they are not used to execute user code. User code
are executed in Application Pools with separate w3wp.exe processes,
which you *can* control the user credentials, and those credentials
are the minimally privileged Network Service account by default.

If you are running Application Pools as LocalSystem, that is not by-
default, so the auditor has a right to complain, and you must explain
to your auditor why it is required by your application or else change
it to something else.

If you are NOT running Application Pools as LocalSystem AND your
outside auditor is complaining about the service credential of IIS6 as
LocalSystem, then it tells me the outside auditor has no idea what s/
he is talking about and is possibly just running through some script
and charging you money for it.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//




On Mar 29, 6:40=A0pm, Don Jones
wrote:
> Thanks, the outside auditor's has made it a requirement for our accrediati=
on;
> If it's not supported, then I'll let them know.
>
> Thanks.
>
>
>
> "Ken Schaefer" wrote:
> > It is not supported running them as any other user. Why do you want to d=
o
> > this?
>
> > Cheers
> > Ken
>
> > --
> > My IIS blog:http://adopenstatic.com/blog
>
> > "Don Jones" wrote in message
> >news:8EE7E3C2-8752-4677-AF10-9690A566BAE9@microsoft.com...
> > > Is it possible to run the IIS services as a user other than the local
> > > system
> > > account? =A0If so, what rights does the user need?
>
> > > Windows Server 2003 w/SP2 IIS 6.0
>
> > > Thanks.- Hide quoted text -
>
> - Show quoted text -

Re: Run IIS

It sounds like the outside auditor has a checklist that's not really based
on anything substative security wise.

Inbuilt services on Windows Server 2003 ship with least privileges as is.
Shifting them to custom user accounts will probably give them more
privileges than they actually require.

As David points out - you would gain more benefit by looking at the user
privileges your web appl pools have (and your Anonymous User account). If
you want to prevent those applications from interfering with each other,
then you may wish to run those as custom user accounts (and ACL your hard
disk files accordingly)

Cheers
Ken

"Don Jones" wrote in message
news:63EC38DD-12C2-4BAD-B93A-980CB094222D@microsoft.com...
> Thanks, the outside auditor's has made it a requirement for our
> accrediation;
> If it's not supported, then I'll let them know.
>
> Thanks.
>
> "Ken Schaefer" wrote:
>
>> It is not supported running them as any other user. Why do you want to do
>> this?
>>
>> Cheers
>> Ken
>>
>> --
>> My IIS blog: http://adopenstatic.com/blog
>>
>> "Don Jones" wrote in message
>> news:8EE7E3C2-8752-4677-AF10-9690A566BAE9@microsoft.com...
>> > Is it possible to run the IIS services as a user other than the local
>> > system
>> > account? If so, what rights does the user need?
>> >
>> > Windows Server 2003 w/SP2 IIS 6.0
>> >
>> > Thanks.
>> >
>> >
>>
>>

Re: Run IIS

Perhaps the auditor actually meant for a specific application/site to run on
a domain-level security or an access-specific account? You can certainly
run sites and applications using different credentials.

Ross

"Don Jones" wrote in message
news:63EC38DD-12C2-4BAD-B93A-980CB094222D@microsoft.com...
> Thanks, the outside auditor's has made it a requirement for our
> accrediation;
> If it's not supported, then I'll let them know.
>
> Thanks.
>
> "Ken Schaefer" wrote:
>
>> It is not supported running them as any other user. Why do you want to do
>> this?
>>
>> Cheers
>> Ken
>>
>> --
>> My IIS blog: http://adopenstatic.com/blog
>>
>> "Don Jones" wrote in message
>> news:8EE7E3C2-8752-4677-AF10-9690A566BAE9@microsoft.com...
>> > Is it possible to run the IIS services as a user other than the local
>> > system
>> > account? If so, what rights does the user need?
>> >
>> > Windows Server 2003 w/SP2 IIS 6.0
>> >
>> > Thanks.
>> >
>> >
>>
>>