Correct NTFS permissions for SharePoint 2007

Question

When deploying new web apps from Central Admin, I am finding that the permissions given to the IIS folders (under \Inetpub\wwwroot\wss\Virtual Directories\web-site-name) only allow accounts with Local Admin rights on the Web Front End server to access the site. Other users get a 403 error.

After a lot of investigation I discovered that newly created Web Applications do not give the Everyone group permissions for Read & Execute, List Folder Contents and Read on the _app_bin folder. All the working Web Application folders have this permission. Adding this permission makes the sites work.

Is my SharePoint installation somehow broken, or is this normal behaviour? We don't frequently set up new web applications in Sharepoint - I do not recall ever having to make this setting change in the past. I also can't find any documentation saying this is a normal step when setting up a new Web Application.

We are running Office Sharepoint Server 2007 Enterprise 64 bit updated to Service Pack 2 and June 2010 Cumulative Update (both WSS and OSS updates applied last June), on Windows 2003 (so IIS6) - could this be a bug introduced by one of the Sharepoint updates?

Does anyone know what the correct permissions are for Virtual Directory folders? Do I need to make any additional changes to make everything work?

Answer 1

You should have these two groups in addition to SYSTEM at a minimum

WSS_ADMIN_WPG (Required) WSS_WPG (Required)

These two will basically house your farm and app pool accounts.

Depending on your configuration you may have additional groups that house other accounts. You can "reset" these settings by running the following:

PSConfig.exe -cmd secureresources

This will cause SharePoint to update NTFS, Registry, DCOM, and user rights permissions.

This is a good bookmark to keep, it lists the permissions required for the above account and more. http://technet.microsoft.com/en-us/library/cc678863(office.12).aspx