Setting up password protection in IIS 7

 GUI, Windows  No Responses »
Apr 072011
 

So you’ve got a client that wants to password protect their sites. Easy-peasy! But wait, they’re running IIS without any sort of control panel? The horrors! Luckily, IIS makes this fairly simple, as long as you’re okay with using Windows user accounts.

Prerequisites

There are a few prerequisites set up for this. If you installed IIS 7 and you know all of the available Security modules are installed, you may skip this step. Otherwise, we need to install the Windows Authentication and URL Authorization modules.

  1. Open Server Manager – Start->Administrative Tools->Server Manager
  2. Navigate Roles->Web Server (IIS).
  3. Click “Add Features”
  4. Ensure that “Windows Authentication” and “URL Authorization” are checked off under the “Security” options.

Creating the User Accounts

  1. Open Computer Management – Start->Administrative Tools->Computer Management.
  2. Expand Local Users and Groups, select Users
  3. Right-click, select New User…
  4. Fill in an appropriate username and password – and I recommend putting the domain name in the Full Name field, for record-keeping. Make sure to uncheck “user must change password at next logon,” and check “Password never expires” to prevent issues down the road.
  5. Repeat as needed.

Set up the IIS site

  1. Open Internet Information Services (IIS) Manager – Start->Administrative Tools->Internet Information Services (IIS) Manager.
  2. Expand the Sites tab and select your domain name
  3. Click Authentication
  4. Right-click Anonymous Authentication, click Disable
  5. Right-click Windows Authentication, click Enable

That’s put IIS out of pass-through anonymous authentication mode using the IUSR and has set it to require a Windows authentication pop-up box. That’s half the battle – now to make sure the site only loads when our specific user inputs their username and password.

  1. Go back to the domain name in IIS and click Authorization Rules.
  2. Right-click on the default rule and click Edit.
  3. Click the radio next to Specified Users and type your username into the box

For more background information on these commands, check out these IIS help pages: Windows Authentication, Security Authorization.