Wednesday, May 14, 2008

IIS IWAM and IUSR accounts

If your IIS applications aren’t working, it could be permissions relating to iusr and iwam accounts.
In order to add domain-based iusr and iwam, you’ll need to sync the passwords on the domain with the local accounts. How do you sync the password? First you need to know what password they’re using.
Apparently you can easily find the password that your iwam and iusr accounts are using the following method:
IIS provides a script file named Adsutil.vbs that you can use to obtain or set the passwords of the IUSR and IWAM accounts to or from the IIS metabase. In Windows NT 4.0, Adsutil.vbs is usually located in the \WINNT\System32\Inetsrv\Adminsamples folder. In Windows 2000, Adsutil.vbs is located in the \Inetpub\Adminscripts folder.
The following table lists the syntax for different functions of the Adsutil.vbs utility:
Function   /   Syntax
Obtain the IUSR account password  /
cscript.exe adsutil.vbs get w3svc/anonymoususerpass
Obtain the IWAM account password /
cscript.exe adsutil.vbs get w3svc/wamuserpass
Set the IUSR account password  /
cscript.exe adsutil.vbs set w3svc/anonymoususerpass "password"
Set the IWAM account password  /
cscript.exe adsutil.vbs set w3svc/wamuserpass "password"
Note :When you try to obtain the password in Windows NT 4.0, the password appears as clear text; however, the password appears as asterisks in Windows 2000. To obtain the password in clear text in Windows 2000, you must modify Adsutil.vbs so that it displays the unmasked password. To do this, follow these steps:
1. In Notepad, open Adsutil.vbs.
2. On the Edit menu, click Find, type IsSecureProperty=True,
and then click Find Next.
3. Change "IsSecureProperty = True" to
"IsSecureProperty = False".
4. Save the changes to Adsutil.vbs, and then close Notepad.

No comments: