RE: [ActiveDir] IIS and Scripting Question

[Coleman, Hunter]

Edwin-   I don't think you're going to find a simple yes or no on the question of whether to put public facing servers in a (separate) domain. Assume for a minute that one of your public servers gets compromised. If it's a standalone server, then the attacker is somewhat constrained in her ability to leverage that server against your other servers. If it's in a domain, then the attacker has a somewhat easier task of expanding the attack to other servers in the domain. Of course, you may find it easier to lock down your public servers via group policy, SUS, and other things if you are able to use domain-based management tools. And you may find that having your users and developers using a single domain account cuts down on the number of passwords taped to monitors and under keyboards.   As is often the case, the closest you'll come to a definitive answer is "It depends..."   Hunter From: Edwin [mailto:[EMAIL PROTECTED] Sent: Wednesday, September 01, 2004 5:26 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question Micheal,   If I may, I would like to ask you a question based off of your last reply to this thread.   You said, "It can't be a part of the domain (our policy is that shared hosting servers (excepting our Exchange hosting servers, which have their own domain) are standalone)"   I share this same opinion while others in the organization I work for insist on having a domain for ease of management and other features.  I believe that there are other ways to "easily" manage servers and use whatever features you want without the use of a domain.   My question to you is if your last statement is based on a preference of your organization or because of a document that gives good arguments as to why a domain should not be used on public servers?  If based on a document, would you be able to share this information?   I have found many documents that say having a domain on a public server is no problem, but that the domain should be isolated from other domains.  But none of the documents give a recommendation as to whether or not it should or should not be used.  I am basically looking for a definite yes or no answer and not something like, "sure, its okay to do."   I don't know if such a document exists, but if there is an official statement from Microsoft about it, I would love to begin an argument with my co-workers about it.   Thank you, Edwin   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, September 01, 2004 2:03 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question   No, the provisioning application needs to be able to create a folder and a file within that folder and assign rights.   It can't be a part of the domain (our policy is that shared hosting servers (excepting our Exchange hosting servers, which have their own domain) are standalone).   Thanks for the thought.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al Sent: Wednesday, September 01, 2004 1:53 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question So really the rights you need are the ability to open a file on a file share you have rights to?  Is it possible to make it part of the domain? You could use the machine account or the IIS account then.  If not, then the trick here is to allow file system access to the application (the user-context of the application really).   Would that work?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, September 01, 2004 1:48 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question I have a provisioning application that runs on a domain member that needs administrative access to a standalone server.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al Sent: Wednesday, September 01, 2004 1:27 PM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] IIS and Scripting Question Credentials other than the ones that IIS is running under?   Personally, I haven't seen a way to do that and wonder why you would want to do it that way?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, September 01, 2004 9:33 AM Subject: [ActiveDir] IIS and Scripting Question Is there any way to create a FileSystemObject with alternate credentials, similar to what I can do with OpenDSObject for an ASP web page?   Thanks, M