RDP User Cannot Access IIS Server

Arjun Goel (DevOn) 0 Reputation points
2024-03-08T06:11:53.5433333+00:00

Hello, I am trying to grant a Remote Desktop Protocol (RDP) user access to my Internet Information Services (IIS) server. I want to prevent them from creating new bindings or modifying existing ones. So far, I have created the user and added them to the Remote Desktop group. Then, I locked down the IIS folder C:\inetpub\wwwroot access for that user to Read, List, and Read & Execute.

I am using IIS version 10.0.20348.1 and I added the RDP user inside the IIS_IUSRS group as used from IIS 7 and later version. I also followed the documentation for granting access rights to the anonymous user found at https://video2.skills-academy.com/en-us/iis/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis. However, when I logged in to the server as the RDP user, I was unable to see the server node and the list of sites and directories. Additionally, when I attempted to add a site, I received an error message as shown in the attached screenshot.

iis_site_configure_error

Please let me know what I am missing from my infrastructure provisioning.

Internet Information Services
Remote Desktop
Remote Desktop
A Microsoft app that connects remotely to computers and to virtual apps and desktops.
4,551 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Yurong Dai-MSFT 2,816 Reputation points Microsoft Vendor
    2024-03-08T08:04:10.88+00:00

    Hi @Arjun Goel (DevOn),

    By default the remote IIS management is disabled, and if you try to add a remote server with the running IIS to the IIS Management Console (Connect to a Server menu) on another server, the following error message appears:

    Could not connect to the specified computer . Details: Unable to connect to the remote server

    The matter is that IIS Management Service is not being installed during the IIS installation . You can install the Management Service component from the Server Manager console. Then restart the IIS web service.

    User's image

    The next step is to allow remote connections in the IIS web server settings. To do it, open Management Service item in the Management section of IIS Manager.

    User's image

    Check the “Enable remote connections” option in Management Service section.

    Here you can restrict connections to the IIS Management Console by IP address. To do it, deny connections for unspecified clients (Access for unspecified clients: Deny) and specify IP address/ IP subnets for which the connections are allowed. The remote connection service uses an SSL certificate, but you can use another one if you imported it into the server’s certificate store (you can create and use a self-signed SSL certificate). Save the changes.

    User's image

    After that, a remote IIS web server can be added to the IIS Manager console and you can manage the IIS server, multiple sites on it the same way as the local web server.

    By default, only users with administrator privileges have the permission to remotely manage the IIS server. In order to grant the permission to IIS remote management for standard users, it is necessary to grant the corresponding permissions at the level of each IIS website. Select a site and find the IIS Manager Permissions option.

    IIS Manager Permissions

    In the Actions panel, click on Allow User. Select the user account to which you want to grant access to IIS and click OK.

    allow user to remotely manage the iis website

    User permissions to manage sites on IIS server are configured in the Feature Delegation section at the IIS server level. You can select one of three user access levels for each IIS server management functional: Read Only, Read/Write or Not Delegated.

    User's image

    For more details, please refer to this official Microsoft document:

    https://video2.skills-academy.com/en-us/iis/manage/remote-administration/configuring-remote-administration-and-feature-delegation-in-iis-7


    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the email notification for this thread.

    Best regards,

    Yurong Dai

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.