Home > Ask the Security Experts > Identity Management and Access Control Questions & Answers > How to implement IIS authentication settings
Ask The Security Expert: Questions & Answers
EMAIL THIS

How to implement IIS authentication settings

Joel Dubin, past SearchSecurity.com expert EXPERT RESPONSE FROM: Joel Dubin, past SearchSecurity.com expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 21 January 2007
I have installed a standalone IIS server on a Windows 2000 system. How can I switch off the authentication window that pops up on a remote computer when trying to access the page?

>
This depends on what you're trying to do. If you want to allow open access to a Web site hosted on your Internet Information Services (IIS), you'll need to check two settings on the server to see which is blocking the site.

There are two levels of authentication for an IIS server hosted on Windows 2000: Web authentication and New Technology File System (NTFS) permissions.

IIS authentication is set through the Internet Service Manager (ISM), which can be accessed from the server's Administrative Tools menu. Under the Directory Security tab, there are a variety of authentication options that can be checked off. These include options for Basic Authentication, Digest Authentication, as well as Integrated Windows Authentication.

The ISM allows more than one type of authentication to be selected. The pop-up window you describe could be a Basic or Digest authentication window, so make sure these two options are deselected.

The other reason for the authentication window issue could be that the NTFS permissions in the server's root directory may have been set to restrict access. This directory is usually located here: C:Inetpubwwwroot. If you want to remove any logon windows or have open access, go to this location and check the Everyone box; this will allow anyone to have free access to the directory.

From the perspective of the Windows 2000 machine itself, these Web server directories are just like any other directory on the server and can be configured separately.

More information:

  • Michael Cobb explains how to create access rules and configure IIS server permissions.
  • Using a different Web server? Learn some non-IIS best practices.


  • BROWSE BY TAG
    Identity Management and Access Control,   Expert Archive: Identity Management and Access Control,   Web Security Tools and Best Practices,   Application and Platform Security,   Web Server Threats and Countermeasures,   Web Application and Web 2.0 Threats,   VIEW ALL TAGS

    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



    RELATED CONTENT
    Identity Management and Access Control
    Is Identity Management as a Service (IDaaS) a good idea?
    How to log in to multiple servers with federated single sign-on (SSO)
    How to confirm the receipt of an email with security protocols
    Learn about enterprise strategy for server virtualization single sign-on
    Employee information security awareness training for new IAM systems
    Can you combine RFID tag technology with GPS to track stolen goods?
    Is there a free enterprise-caliber password-management tool?
    Cryptosystem attacks that do not involve obtaining the decryption key
    Can any firm or organization get a digital signature certificate?
    Should the CTO have domain administrator access?

    Expert Archive: Identity Management and Access Control
    Enterprise password management policy: Finding the balance
    How to conduct a periodic user access review for account privileges
    Options for a mechanical door security system on a server room door
    Comparing access control mechanisms and identity management techniques
    User provisioning and SSO for PeopleSoft- and Unix-based products
    Could someone place a rootkit on an internal network through a router?
    Should a new user have to confirm an email address to gain access?
    Can home PCs provide a way for viruses and spyware to enter a corporate LAN?
    What should an enterprise look for in a password token and a vendor?
    Using batch files for temporary user access to the local admin group

    Web Server Threats and Countermeasures
    Increase in Gumblar backdoors poses FTP credential problems
    VeriSign extends DDoS attack protection service
    Microsoft issues IIS FTP advisory, exploit code circulates
    Panda reports fast-spreading rogueware antivirus fraud rakes in millions
    Oracle issues quarterly patches, fixes database flaws
    Latest DDoS attacks extremely unsophisticated, experts say
    Stolen FTP credentials likely in massive website attacks
    Microsoft warns of IIS zero-day vulnerability
    How to find and stop automated SQL injection attacks
    How to spot attacks through Apache Web server log analysis

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    cache cramming  (SearchSecurity.com)
    content filtering  (SearchSecurity.com)
    Web filter  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts