jimtut's questions

I posted a question earlier this week about our IIS8.5/WebDAV setup: IIS8.5 with WebDAV only serves read-only files

I have the basics working, but now having trouble with mapping the WebDAV to a drive letter on a client PC (Windows 10).

My IIS setup looks like this:

The highlighted "Z-Drive" app points to the Z: drive on the server. Just below that is a separate Site (running on port #8080) that has the exact same setup (same physical path, same app-pool, same WebDAV Authoring Rules).

However, these 2 URLs behave very differently!

1. http://server/Z-Drive can be mapped to a local drive letter on a PC, but it's read-only. Testing this with curl (curl --ntlm --u username:password -T file.docx http://server/Z-drive) returns a 409.0 error ("Conflict").
2. http://server:8080 works properly with curl (same curl command copies the file to the server), but that URL cannot be mapped as a local drive letter. net use Z: http://server:8080 gives System error 1920 has occurred. I can map sub-folders of that Z: drive (net use Z: http://server:8080/subfolder), but I need the users to be able to get that whole Z: drive through WebDav, as one drive one their PC's.

I'm willing to use either URL (http://server/Z-Drive or http://server:8080), but one maps to a drive-letter as read-only and the other won't even map. Any suggestions for either problem?

I have a server running Windows Server 2012 R2 with IIS 8.5. I've configured it for remote management, and I am able to successfully connect to the IIS mangement service (on this server) from another computer, as long as I login with an "admin" account (an acct that's in the local Administrators group on the server).

I've tried to enable IIS Manager to allow non-admin accounts:

1. I've enabled the remote Management Service:
2. I've added some non-admin users:

But, the non-admin users cannot connect to the IIS remote mgmt service:

As soon as I switch to an acct which is an admin on that server, it works:

How can I get IIS to allow non-admins to connect to the remote management service?

UPDATE: Based on the answer given below, non-server-admins need to choose the IIS Manager option "Connect to a Site", not "Connect to a Server". When you choose that option, you'll need to specify the Server name and the Site name:

Windows Server 2012 R2 with IIS 8.5 and the WebDAV feature installed and enabled. It looks like all the basics are working:

$curl --ntlm -u username:password -i -X OPTIONS http://server/file.docx

HTTP/1.1 200 OK
Allow: OPTIONS, TRACE, GET, HEAD, POST, COPY, PROPFIND, DELETE, MOVE, PROPPATCH, PUT, LOCK, UNLOCK
Server: Microsoft-IIS/8.5
Public: OPTIONS, TRACE, GET, HEAD, POST, PROPFIND, PROPPATCH, MKCOL, PUT, DELETE, COPY, MOVE, LOCK, UNLOCK
DAV: 1,2,3
MS-Author-Via: DAV
Persistent-Auth: true
X-Powered-By: ASP.NET
Date: Wed, 07 Dec 2016 05:10:15 GMT
Content-Length: 0

Also:

$curl --request PROPFIND --ntlm -u username:password  --header "Content-Type: text/xml" --header "Brief:t" --data "<D:propfind xmlns:D='DAV:'><D:prop><D:displayname/><D:getcontentlength/><D:getlastmodified/></D:prop></D:propfind>" http://server/file.docx

<?xml version="1.0" encoding="utf-8"?>
<D:multistatus xmlns:D="DAV:"><D:response>
<D:href>http://server/file.docx</D:href>
<D:propstat><D:status>HTTP/1.1 200 OK</D:status>
<D:prop>
<D:getlastmodified>Wed, 07 Dec 2016 04:26:19 GMT</D:getlastmodified>
<D:displayname>file.docx</D:displayname>
<D:getcontentlength>16265</D:getcontentlength>
</D:prop>
</D:propstat>
</D:response>
</D:multistatus>

UPDATE: Also found the curl commands to delete a file from the server and to upload a file, and they all work too:

$curl --ntlm -u username:password -X DELETE http://server/file.docx
$curl --ntlm -u username:password -T file.docx http://server/

Based on all the curl tests, the basic WebDAV seems to be working, but no matter how I try to open this file/URL in Microsoft Word, it only opens read-only.

I've tried pasting the URL into MS Word's "Open File" dialog box, I've launched Word from the command line with the URL to this file, I've even tried some MS Office protocol handlers (ms-word:ofe|u|http://server/file.docx) from a web page.

Every time I get read-only. Any suggestions on how to get MS Office to use this WebDAV properly? I've used the same MS Office with another WebDAV implementation (Atlassian Confluence), so I'm hoping it's just some Office config or command-line switch needed.

We have a departmental web server running Server 2003, IIS 6, and SQL Server Express. IIS is configured for Windows Authentication only and all the App Pools are configured to use the Network Service account. We run several ASP.NET apps, most of which access SQL Server DBs. In the web.config (or other places) within those apps, we have the required connection strings to access the DBs.

I recently realized that anyone could browse the share holding the web server files ("Authenticated Users" have Read permission), as it's underneath another directory on the server that's shared for various reasons.

I tried to remove that "world-read" access permission, but then users could no longer run the apps (they couldn't read the fileshare, which was the intended behavior, but this prevented them from running the apps too). I could still run the apps, as I'm part of the admin group that still had Full Control over the apps folder.

My question (finally) is: what combination of Windows permissions and IIS settings could I use in order to meet these needs:

1. We need to know which users are using the app, and to determine what roles/permissions the current user has in each app.
2. We need/desire to keep the DB connection strings in the web.config or other app files (too much work to move all them somewhere else).
3. We need to prevent users from browsing the fileshare and reading things like connection strings inside the apps. (We'd like to NOT have to move the apps to a new share!)

I've been struggling with this for a while, and would appreciate any suggestions!

For space reasons, we need to move some files off our main file/webserver to another network fileserver. However, the original file/webserver is still responsible for providing access to these files, so that everything is seamless to the users.

I can provide transparent file access by using DFS on the original server. I can also provide transparent web access using an IIS Virtual Directory.

However, Perl CGI scripts running on the webserver can't access the new (remote) fileserver using UNC paths. This code snippet:

if (-e "\\\\server\\share\\file") { print "Found it\n"; }
else { print "Not found\n"; }

works on my local PC, but not on the webserver. I've been Googling around, and have run into similar examples, but no solutions.

Some environment info:

• Original File/Webserver: Windows Server 2003

• New Fileshare: IT NAS server, but I have full control over permissions, and have granted the local "IUSR" account from the Webserver permission to read this share

• IIS: Version 6

• IIS Authentication: Integrated Windows Authentication

• IIS Virtual Directory: configured to use a single AD user's security credentials to access the destination dir

Any help would be greatly appreciated!