Hi,

We recently introduced XP onto our developers workstations who require
access to IIS to develop websites. When we built the new systems we thought
it would be a good idea to remove the user from the local admins group to
prevent them from installing the own applications, programs etc. However,
once the user is removed from the local admins group on their wokstation they
are no longer able to administer IIS due to the restrictions of being a
standard user. We tried adding the user to the Power Users group, but this
also failed.

Is there anyway of giving the user rights to access the IIS MMC? Or the
option maybe to look into a 3rd party app or utility that prevents the user
from installing their own software which was the original reason for changing
their rights in the first place.

Thanks in advance,

--
Simon

AFAIK, you must have admin rights to admin IIS.


"Simon" <(E-Mail Removed)> wrote in message
news:570577ED-67F6-485E-BAB5-(E-Mail Removed)...
> Hi,
>
> We recently introduced XP onto our developers workstations who require
> access to IIS to develop websites. When we built the new systems we
> thought
> it would be a good idea to remove the user from the local admins group to
> prevent them from installing the own applications, programs etc. However,
> once the user is removed from the local admins group on their wokstation
> they
> are no longer able to administer IIS due to the restrictions of being a
> standard user. We tried adding the user to the Power Users group, but this
> also failed.
>
> Is there anyway of giving the user rights to access the IIS MMC? Or the
> option maybe to look into a 3rd party app or utility that prevents the
> user
> from installing their own software which was the original reason for
> changing
> their rights in the first place.
>
> Thanks in advance,
>
> --
> Simon

I'll reinforce what Scott said, if they are developing, especially Windoz
apps, whether web based or PC based, they'll need "local" admin rights -
developing requires access to parts of the OS that only an Admin can reach.
Now the app they are developing may not need to access, but the process of
developing itself requires it. No third party software is going to be able
to help - it is just the way it is.
Now, provided you are running AD on your domain, you can prevent certain
access via Group Policy, but you have to be careful with developer machines,
the wrong change can completely cripple the development software.

--
Star Fleet Admiral Q @ your service!
"Google is your Friend!"
www.google.com

***********************************************

"Simon" <(E-Mail Removed)> wrote in message
news:570577ED-67F6-485E-BAB5-(E-Mail Removed)...
> Hi,
>
> We recently introduced XP onto our developers workstations who require
> access to IIS to develop websites. When we built the new systems we
thought
> it would be a good idea to remove the user from the local admins group to
> prevent them from installing the own applications, programs etc. However,
> once the user is removed from the local admins group on their wokstation
they
> are no longer able to administer IIS due to the restrictions of being a
> standard user. We tried adding the user to the Power Users group, but this
> also failed.
>
> Is there anyway of giving the user rights to access the IIS MMC? Or the
> option maybe to look into a 3rd party app or utility that prevents the
user
> from installing their own software which was the original reason for
changing
> their rights in the first place.
>
> Thanks in advance,
>
> --
> Simon

On Tue, 08 Mar 2005 18:47:25 -0500, Admiral Q wrote:
>
> I'll reinforce what Scott said, if they are developing, especially Windoz
> apps, whether web based or PC based, they'll need "local" admin rights -
> developing requires access to parts of the OS that only an Admin can reach.
> Now the app they are developing may not need to access, but the process of
> developing itself requires it. No third party software is going to be able
> to help - it is just the way it is.
> Now, provided you are running AD on your domain, you can prevent certain
> access via Group Policy, but you have to be careful with developer machines,
> the wrong change can completely cripple the development software.

We have a developers network inside the local network. All developers sit
behind a simple NAT router and their systems are part of their own domain
or local workgroup. By putting them inside a subnetwork with their own
systems and keeping them out of the company network domain/security it
allows them to manage all sorts of things that you would not want them
managing on your network.

As an example, you can setup several SQL servers and several web servers
as QA and then Pre-Production and give them access as Administrators
without those servers belonging to your company network - same with their
workstations. The only thing you need to make clear is that they get
quality AV software on their machines.

Also, by putting them inside the company network in their own subnet
behind a router, it lets them access company email services, and lets you
filter their web access.

You can use the DMZ of your company network to setup SQL and Web servers
that they can push to from their LAN, but that DMZ area is where the
customers review the work/projects. Keeps the need for external
connections to the developers network eliminated.

--
(E-Mail Removed)
remove 999 in order to email me

Hi Simon

a third party product that would allow you to run iismgr.exe as admin is
PolicyMaker Application Security from www.desktopstandard.com

HTH
--
marco [alla] neovalens [punto] com

[ www.neovalens.com ]
----


"Simon" <(E-Mail Removed)> wrote in message
news:570577ED-67F6-485E-BAB5-(E-Mail Removed)...
> Hi,
>
> We recently introduced XP onto our developers workstations who require
> access to IIS to develop websites. When we built the new systems we
> thought
> it would be a good idea to remove the user from the local admins group to
> prevent them from installing the own applications, programs etc. However,
> once the user is removed from the local admins group on their wokstation
> they
> are no longer able to administer IIS due to the restrictions of being a
> standard user. We tried adding the user to the Power Users group, but this
> also failed.
>
> Is there anyway of giving the user rights to access the IIS MMC? Or the
> option maybe to look into a 3rd party app or utility that prevents the
> user
> from installing their own software which was the original reason for
> changing
> their rights in the first place.
>
> Thanks in advance,
>
> --
> Simon