ColdFusion and IIS "see" things differently. ColdFusion doesn't care about IIS settings or permissions granted to the application pool identity. It will use the ColdFusion service identity only. So whatever files/folders you have granted the ColdFusion service account access to, that's all it can see/interact with (think how this applies to CFINCLUDE, CFINVOKE, CFFILE, etc.). IIS, on the other hand, is more complex. If you enable Anonymous authentication on a web site, any requested files will only be accessible if permissions to those files/folders have been granted to the appropriate application pool identity. If you are using Windows authentication, any requested files will only be accessible if permissions have been granted to the Windows user that is browsing that site. On my web server, I put all of my web applications inside of a E:\WebSites folder. I have granted the following permissions on that folder: ColdFusion Service Account: Modify, Read & execute, List, Read, Write. I might be able to restrict that to just read if ColdFusion isn't creating/modifying files in my apps (I'll have to check that further). IIS Service Account (this is the Application Pool root user): Read & execute, List, Read. Users (this Local group account usually includes the AD Domain Users group account): Read & execute, List, Read. If your web application, or portions of it, should only be accessible to a select group of users, then don't use Anonymous authentication, and don't give the local Users group access to the restricted areas. Create an AD Group that contains that select group of users, and grant that AD Group the Read & execute, List, and Read permissions to those restricted areas. -Carl V.
... View more