RE: [ActiveDir] IIS and Scripting Question

[Michael B. Smith]

Edwin -   It has been our opinion for years (since our NT4 days) that having non-domain servers reduces the attack surface.   It is just that: an opinion.   Microsoft's recommendations for shared hosting solutions recommends usage of an active directory. (See http://microsoft.com/serviceproviders and the various white papers available there.) When we next upgrade our environment, we will move to a domain.   We used O'Reilly Website for a number of years to reduce the attack surface and War-FTP. But the capabilities of that product, as of IIS 4.0, were less than IIS and our customer based required us to switch to IIS. Some monitoring tools (one we beta'ed, not currently released) and more-and-more functionality is coming to depend on domain membership. As of IIS 5.0, the inbuilt ftp server had sufficient capabilities and we switched to it.   Except for Perl and PHP, and a few DLLs, our webservers are now all Microsoft.   Thanks, Michael From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Edwin Sent: Wednesday, September 01, 2004 7:26 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question Micheal,   If I may, I would like to ask you a question based off of your last reply to this thread.   You said, “It can't be a part of the domain (our policy is that shared hosting servers (excepting our Exchange hosting servers, which have their own domain) are standalone)”   I share this same opinion while others in the organization I work for insist on having a domain for ease of management and other features.  I believe that there are other ways to “easily” manage servers and use whatever features you want without the use of a domain.   My question to you is if your last statement is based on a preference of your organization or because of a document that gives good arguments as to why a domain should not be used on public servers?  If based on a document, would you be able to share this information?   I have found many documents that say having a domain on a public server is no problem, but that the domain should be isolated from other domains.  But none of the documents give a recommendation as to whether or not it should or should not be used.  I am basically looking for a definite yes or no answer and not something like, “sure, its okay to do.”   I don’t know if such a document exists, but if there is an official statement from Microsoft about it, I would love to begin an argument with my co-workers about it.   Thank you, Edwin   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, September 01, 2004 2:03 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question   No, the provisioning application needs to be able to create a folder and a file within that folder and assign rights.   It can't be a part of the domain (our policy is that shared hosting servers (excepting our Exchange hosting servers, which have their own domain) are standalone).   Thanks for the thought.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al Sent: Wednesday, September 01, 2004 1:53 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question So really the rights you need are the ability to open a file on a file share you have rights to?  Is it possible to make it part of the domain? You could use the machine account or the IIS account then.  If not, then the trick here is to allow file system access to the application (the user-context of the application really).   Would that work?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, September 01, 2004 1:48 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] IIS and Scripting Question I have a provisioning application that runs on a domain member that needs administrative access to a standalone server.   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mulnick, Al Sent: Wednesday, September 01, 2004 1:27 PM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] IIS and Scripting Question Credentials other than the ones that IIS is running under?   Personally, I haven't seen a way to do that and wonder why you would want to do it that way?   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Michael B. Smith Sent: Wednesday, September 01, 2004 9:33 AM Subject: [ActiveDir] IIS and Scripting Question Is there any way to create a FileSystemObject with alternate credentials, similar to what I can do with OpenDSObject for an ASP web page?   Thanks, M