Using the Permissions Wizard

The Windows 2000 Resource Kit

IIS 5.0 includes a new option—the Permissions Wizard. This Microsoft Windows 2000 Resource Kit utility is an alternative to Internet Service Manager (ISM), which forces you to walk through the process of setting permissions manually. The Permissions Wizard automates many of the permissions-related tasks that you use ISM to perform. For example, to set permissions, you might need to access two dialog boxes in ISM, whereas the wizard can perform the same task in one step. Because the Permissions Wizard depends on the IIS security system, you can't make any changes with it that you can't make directly with ISM.

You can use the Permissions Wizard to

Using the Permissions Wizard, you can select the scenario in which you're using the virtual directory and set the permissions from a template that matches that scenario.

IIS comes with three default templates:

IIS stores these templates in the IIS metabase. A template contains access control permissions, authentication methods, and IP address restrictions properties. The templates don't create new types of security settings; instead, you use them to set the standard IIS settings. These authentication methods are the same as those you can use ISM to set.

The Permissions Wizard sets all the IIS security properties in a few steps. (The wizard can set NTFS permissions only on directories and files.) The time you save when you use the wizard becomes important when you consider how long it takes to individually configure a group of Web sites or virtual directories that all share the same permissions. With the Performance Wizard, you can set the same permissions for each of these entities simply by selecting the same template.

Permissions Wizard Template Maker
To create new or modify existing permissions templates, you can use another resource kit utility—Permissions Wizard Template Maker. Permissions Wizard Template Maker makes it easy to create custom templates for server farms or any group of sites that require the same type of security. To install Permissions Wizard Template Maker, follow these steps:

Using Permissions Wizard Template Maker
Before you run the wizard, be sure to back up the metabase. To begin creating or modifying a template, start Permissions Wizard Template Maker from ISM by selecting IIS Permissions Wizard Template Maker from the Programs folder you selected when you installed the utility. On the first page of the wizard, click Next to access the Creating and Editing Templates page, which Figure 1 shows. On this page, you can either edit an existing template or create a new one. For this example, choose the Design New Template option. Select either FTP Site or Web Site, depending on the type of site to which you'll apply your template. Click Next.

On the wizard's next page, select the authentication options for the template. Although you can set any authentication option on this page, particular options might not be available on the server to which you apply the template. For example, you can select Digest authentication for a template, but unless the server to which you apply the template is part of a domain, Digest authentication won't work. (Digest authentication works only with domain accounts, and Permissions Wizard Template Maker apparently doesn't take this fact into account when it presents the authentication options.)

When you've established the authentication settings, click Next to bring up the Access Permissions page. This page lets you set the permissions for the directory. Select your permissions, then click Next to access the IP Address and Domain Name Restrictions page, which Figure 2 shows.

On the Restrictions page, you can set a filter for who can access your site by either granting or denying access by IP address or domain name. To set the filter, you must select either the Granted Access or Denied Access option and enter the applicable addresses, computer names, and domain names. Click Next.

On the next page, select a name for the template. You can also enter a description for the template. Click Next, then click Finish.

Editing existing templates. In addition to creating new templates, you can edit existing templates. When you edit a template, the tool edits the existing template and doesn't save a copy of the original template. To edit a template, start Permissions Wizard Template Maker, then click Edit Existing Template on the second page of the wizard. Select the template to edit. From this point on, your choices are the same as those for a new template. Click Finish to update the template.

Using Permissions Wizard Templates
To use your new template, start the Permissions Wizard in ISM and click Next on the first page. Choose the Select new security settings from a template option, then click Next to bring up the Site Scenario page, which Figure 3 shows. Select your template from the Scenario list box. Click Next.

On the next page, choose the directory and file permission options (e.g., Replace all file and directory permissions), then click Next. Click Next again, then click Finish to apply the permissions to the site or virtual directory you selected.

Using inherited permissions. You can also use the Permissions Wizard to return the settings for a virtual directory or site to its parent. To reset the permissions to Inherited, start the Permissions Wizard and click Next on the first page. On the second page, click Inherit all security settings, then click Next. Select the file permissions, then click Next. Click Next again, then click Finish to apply the permissions. When you apply a template to a directory or Web site, all the directories or Web sites that inherit settings from your selected directory or Web site also inherit the settings from that template. Directories or Web sites that don't inherit settings aren't affected.

Permissions Wizard Limitations
The Permissions Wizard lets you either use templates or inherit security settings from the parent of a virtual directory or site. This functionality doesn't prevent you from using ISM to change those permissions at a more granular level after you've run the Permissions Wizard. The wizard sets many properties, but it's an automation tool and doesn't completely replace or control these settings.

The wizard has one drawback. As I mentioned, IIS stores the templates in the metabase. As a result, multiple computers can't easily share them, which makes it difficult to create a template and then use it to configure several different systems. Other add-on tools that Microsoft provides, such as the Security Toolset, let you configure these systems nicely. Be aware of this limitation before you spend a lot of time building templates.