none
Can't add IIS_IUSRS Group in Group Policy.

    Question

  • Hi,

    I'm trying to lockdown a local folder on certain machines by using Group Policy (Computer Configuration > Policies > Windows Settings > Security Settings > File System).

    One of the permissions we need to assign to the local folder is the local IIS_IUSRS group, however Group Policy does not see this local builtin account.  Our systems are on Windows 2003 Active Directory.  Does any know how I can add this permission through GPO to lockdown a local folder?



    Kevin.

    Thursday, May 26, 2016 12:43 PM

Answers

All replies

  • > Does any know how I can add this permission through GPO to lockdown a
    > local folder?
     
    Edit the GPO on the server in question... But be aware: This will add
    the group SID to the GPO (not the group name), so it will NOT work on
    any other server.
     
    Friday, May 27, 2016 10:12 AM
  • Hi,

    Thanks for your post.

    First, please understand that Windows Server 2003 is out of support. It is suggested to upgrade the newest version to get better user experience and embrace the new feature.

    Would you please tell me what’s the purpose of this operation?

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, May 30, 2016 9:29 AM
    Moderator
  • Hi Martin, Finally resolved the issue. I needed to edit the group policy from the server that contained IIS, which then allowed me to add Builtin\IIS_IUSR into the policy. Thanks.

    Kevin.

    Thursday, June 2, 2016 8:12 AM