SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 2 web front ends in our single sharepoint 2010 Farm named WFE1 and WFE2. We create 2 web applications, one for my Intranet and one for extranet solution. Is it possible to force our intranet web app to be provisionned on WFE1 only and Extranet Web app to be provisioned to WFE2 only.

This is to isolate content for security reasons.

share|improve this question

There is no way to tell SharePoint to put a WFE on only one server in the farm. However, even if it did, merely putting one WFE on one server only provides the illusion of isolation as the service accounts used on both boxes would have the same network permissions and both would have the ability to utterly corrupt their underlying content databases (at least!) should they be compromised.

If you need true isolation, then you will need to create a separate farm with separate service accounts and isolate that farm between two firewalls (this is a best practice anyway) One Firewall is between the Extranet farm and the internet and the other is between the farm and the Intranet. It is also recommended that all machines that run in the area between the two firewalls be in their own domain and that this domain not have a two-way trust with the Intranet domain.

However, business demands sometimes require that actions be taken that are less than ideal. As such, the "lite" version is to make sure that the service account that is used for the Application Pool used by the Extranet Site have the least permissions possible on the internal network, the farm servers themselves and on the underlying database server. Under no conditions should this account be in any Administrators group anywhere nor should it be used for any other application pool other than the one for the extranet. This provides at least a basic protection layer but - again - this is not recommended as it isn't truly secure and would not pass even a cursory security audit.

Next is to configure your external DNS so that the extranet site url goes directly to the server that you want to exposed to the internet. Also, make sure the the Intranet site URL is not visible in any way on your external DNS. Your internal DNS can be configured however you wish but for simplicity it would make sense to map each URL to the server desired rather than to a load balanced URL.

This whole topic can get a great deal more complicated and Microsoft has some documentation to explain the official options that are available here and here.

share|improve this answer

You can stop the sites you do not want to run in IIS.

Watch out - potentially someone can inadvertently start turned off sites. There are a whole lot of issues including where the server is located when talking of extranet scenarios -if this meets your security needs - you have to evaluate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.