Home All Groups Group Topic Archive Search About

Adding a local computer account into AD

Author
9 Mar 2006 4:37 PM
ssmith
Is there a way to add a local computer account, for example
IUSR_<COMPUTERNAME> into AD? I need to grant permission for the IUSR account
on one server to access a network share. Since the IUSR account is local to
the machine, I'm not able to add it under permissions for the network share.
As well, I can't join the IUSR account to an AD group to allow it to access
the share. Any info would be greatly appreciated.

Author
9 Mar 2006 8:15 PM
Paul Williams [MVP]
Why would you want to do this?  The only IUSR_ accounts that should be in
the domain are those that correspond to DCs that have IIS installed for
whatever reason.

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net
Author
9 Mar 2006 10:07 PM
ssmith
Our dev is creating an application to parse information from a database and
store it in an XML file in a directory that is shared out. The other part of
this is the outside source accessing the information will pass a url to the
IIS server which then retrieves the xml file or places a new xml file into
the shared directory.

Now why they are doing this in this manner is beyond me, only that I was
asked by our dev if it was possible to have the IUSR_<computer> account
access the shared directory.

The only method I can think of is to give the server which is running IIS
permission on the shared directory. Since the server is a member server, I'm
tempted to test the permissions by adding it to sharing and adding it to
security, then seeing if the dev can pass the file that way.
Author
10 Mar 2006 8:23 AM
Paul Williams [MVP]
I'm not an IIS man, so don't know how to do this.  However it should be
setup in such a way that IIS is either accessing resources using the user
who is accessing IIS' credentials (delegation) or the computer account of
IIS is accessing the shared folder.

You might find posting to the IIS groups more beneficial.  I can't
cross-post into that group as neither of use retain the original post in our
replies.

I've also modified the subject line in the hope that Joe K sees this - he'll
know the answer in a second...

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net
Author
10 Mar 2006 2:32 PM
ssmith
Thanks for the info Paul, will definitely post under the IIS group.

Steve