One of my developers asked me to grant permission to IUSR_ user (the IIS user) to CMD.exe (console) now I'm wondering is it safe to do it? He is complaing, that his libraries had to use console for working good. What do you think?
In my opinion, there are two problems here:
Ask him exactly what he's launching, and ask if he can find a workaround. If he's running some sort of external task, why isn't he using the Windows Task Scheduler API rather than directly spawning shells? If he's using an existing utility (e.g.
Remember that a flat "no" is useless to him as a developer. Explain exactly why it'd be a security issue. If possible, back it up with something from your security policy. Try to be empathetic of his situation - developers usually have 6 months worth of work to get done in 6 weeks, so a workaround is golden. If it's a case of him not having the time to do the job properly, speak to the project manager and see if the scope can be altered.