Home / server / Questions / 280077
Accepted
anonymous
Asked: 2011-06-14 14:04:17 +0800 CST

Problem viewing Active Directory users from external server

  • 772

I'm trying to set up a website on an external web server (IIS 6 on Win 2k3) such that:

  • Anonymous access is denied
  • Users have to log in with their Active Directory username / password
  • I can grant specific permissions to specific users in Windows Explorer

I think I have correctly established a VPN connection between the two servers. In fact the IIS side of it works! However, in Windows Explorer, when I click on the Security tab, I cannot see the AD domain, so I cannot search for the users I need to grant permissions to.

EDIT: Per mfinni, I am adding more detail:

In IIS 6, I can go to a website > Properties > Directory Security > Authentication and Access Control. I can then uncheck "Enable anonymous access," check "Basic Authentication," and then for the "Default Domain" I can click on "Select...". In the popup that appears, I can see the domain! Moreover, when I choose the domain, my website now requires me to authenticate, and the credentials stored in the remote Active Directory work.

On the other hand, I also need finer control over individual files and folders, as I need to grant filesystem permissions to individual AD users. In Windows Explorer (Windows 2003), I right click on a folder, choose the "Security" tab, and click "Add...". This brings up the "Select Users or Groups" dialog. Under "From this location" I see the name of the local machine. This is where the problem is. If this were configured correctly, I would be able to click "Locations..." to see a list AD domains. However, all I see is the name of the local machine.

security active-directory iis remote

1 Answers

  1. Best Answer

    If the IIS machine isn't in the domain (or in a domain that trusts your internal domain), this won't work. If it's in the domain, then your VPN tunnel isn't set up right.

    Edit with new info in question - Windows Explorer will only show you users and groups from domains that it knows about : either its own domain, or trusted domains. Is your IIS machine in this domain or a trusting domain?

    Further edit - I think there's something wrong with your connection to the domain. Check the event logs on the IIS server.

    • 3