The best practices wants me to create a local group (which I did, called COMPUTERNAME\Web Services) and to add the DOMAIN\WebAdmin, Local System and Local Service accounts to it. Well, I added the DOMAIN\WebAdmin, but when I did a search for all local security principal accounts, it listed: NT AUTHORITY\Network NT AUTHORITY\Network Service NT AUTHORITY\Service NT AUTHORITY\Local Service NT AUTHORITY\System Notice that there's no 'NT AUTHORITY\Local System'. My thought is that the 'Network Service' and 'Local Service' are legit, but where is 'Local System'? There's only 'System' So if the OS is using 'System' instead of 'Local System', then maybe 'Network' (for Network Service) and Service (for Local Service) are the actual accounts I need to add. I have done extensive Google searching, and cannot find a site that tells me the difference between Network vs. Network Service and Service vs. Local Service. I think the CF9 Lockdown guide only suggests putting the ColdFusion and IIS Service account in the Web Services group. I don't htink Local System and Local Service are necessary. As for your explanation of how you setup your website, that makes a lot of sense now. Putting the CF service on that folder root with those rights ensures that all sites with home directories under it will have CF rights on their folders inherited from that level. You pretty much did similar with the IIS service account. The local Users account, in my case, being on a domain, I would add DOMAIN\Domain Users group to it so for Windows Authenticated Sites, I could use that 'Users' group to define what areas of access they have. I think my initial problem was that for 1 request, I was assuming that only 1 service ultimately was checked, and as we see here, CF and IIS can both have permission checks done per request. I think you're on the right track here. Let me clarify something I stated earlier about CF and IIS accessing files. When a user attempts to go to index.cfm (or any other .cfm page), the request first goes to IIS. If the IIS credentials (whether it's the app pool for anonymous or the Users group for WIndows authentication) don't allow access to the file, you'll get an error (I think one of the 401 errors). If IIS can access the file, it will pass the request to ColdFusion for processing. At that point, the ColdFusion service needs to have permissions to access the file. If you really want to lock down your apps, only grant the IIS service account access to files/folders from the webroot on. This is especially true if you use a framework or methodology that puts your model/service/controller files outside the webroot. IIS should only be able to access files that should be directly accessible via the web browser (or via AJAX requests from within your application). On the other hand, ColdFusion needs to have access to any file that will be processed by ColdFusion (whether accessed via mappings, or via CFINCLUDE/CFINVOKE/CFFILE or other tags/functions). Also, if you intend to serve files on a remote server via IIS Virtual Directories, the same IIS credential rules apply. If you intent to access/process files on a remote server inside ColdFusion code, you'll need to make sure to grant access to the ColdFusion service account. -Carl V.
... View more