0

I have a PC that is used as a server, its OS is Win2008 R2 and the application is developed by ASP.NET 2012 and C#. The server is dedicated to my application and is placed in the user location. Since I can't physically protect unauthorized access to server I'm looking for a suitable method to preventing another person has access to files on the server. I know I can set login password but the HDD can be remove and install on another PC. Is there any way that only IIS Server has permission to access data? (Or any other reliable solution)

Thank in advance, Reza

3
  • 1
    If someone can get physical access to the machine, most other issues are moot. But: an encrypted file-system and ACLs on the important drive locations would go at least some way to making it inconvenient for an attacker... Oct 22, 2013 at 8:47
  • If you want only this IIS box has access to the files, you might encrypt the disk using BitLocker or another encryption product.
    – Lex Li
    Oct 22, 2013 at 9:18
  • @ Marc Gravell: I encrypted root folder but get an error message when requesting page from web browser: "401 - unauthorized access is denied due to invalid credentials"
    – Reza
    Oct 22, 2013 at 9:25

1 Answer 1

0

yes,you can set access to your root folder to only IIS_IUSERS.also you can modify read/write access.enter image description here

1
  • I don't think this will work as IIS_IUSRS on different machines should have the same SID. Then the protection you describe won't stop the files from being read after moving the disk to another Windows machine.
    – Lex Li
    Oct 22, 2013 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.