Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB

3.1. Built-in IUSR Account and IIS_IUSRS Group

Before going on to start analyzing the security context of requests while they take the journey through the IIS 7.0 and ASP.NET unified request-processing pipeline, it is important to give an overview on the new IUSR account and IIS_USRS group.

IIS 7.0 introduces a new built-in account IUSR and a built-in group IIS_IUSRS. The IUSR account replaces the old IUSR_MachineName account that was used previously by the IIS 6.0 web server. The new account is a built-in account, which means its password never expires and hence this improves deployment by not having to worry about password differences between the local IIS_IUSR MachineName account and the remote user account.

Another benefit of the new IUSR account is when you set access control lists (ACLs) for the IUSR account folders inside your application, there is no need to worry about copying these ACLs from your local machine to the remote web server machine. The reason lies behind the fact that the operating system creates unique security identifiers (SIDs) for every account created in Windows, and ACLs are applied on the SID of the account and not anything else. This means when you apply ACLs locally on the IUSR for a folder in your application, those ACLs will be copied with the folder when moved from the local server to the remote web server and the same ACLs will take effect, since all Windows machines that have IIS 7.0, whether the client IIS 7.0 or server IIS 7.0, share the same ...