Web Service Confusion - IIS - How to get web site's current directory and permissions issues

Question

I have a few newbie web service/Windows rights questions since I've typically been a LINUX/embedded dev in the past.

What directories does a web service executing on a server have access to by default?

I ask because I tried to write to C:\\ and got an access violation. I kind of assumed I would in this case, but I assume there are some areas of the file system the web service can write to and read from by default, right? Or is it just the current working directory?

* How can I give a web service permissions to look at a new directory it didn't have default access to? *

This is C# - ASMX - .NET 3.5 - IIS

Answer 1

The WebService doesn't really have any associated access controls associated with it (in a sense). It is however tied to the access control of the user account which is being used to run the application. By default this is usually some built in user account with limited permissions.

IIS uses a number of built-in Windows accounts, as well as accounts that are specific to IIS. For security reasons, you should be aware of the different accounts and their default user privileges. It can be a security risk to change the identity of a worker process so that it runs as an account with a high level of access, such as the LocalSystem user account.

See a list of possible user accounts here: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/3648346f-e4f5-474b-86c7-5a86e85fa1ff.mspx?mfr=true

If you have Anonymous Authentication enabled you can usually check the settings on that to see which account is being used to run the web service. (Depending on which version of IIS you are using, clicking Edit should let you view the default user account)

After finding the account, usually you will have to explicitly grant it the permissions on the folders (read and write) that you want to give it access to. The default user account usually has pretty limited access (and for good reason). You can grant permissions on the Security tab of the properties of any of the folders on a Windows file system (Properties->Security)

If you're using Windows Authentication , then you should have the same access rights as the authenticated user using the application as long as the resources are local to the IIS server.