2

We have a security requirement for IIS 7 (Windows 2008R2) that reads as follows:

The service account ID used to run the web site must have its password changed at least annually.

  1. Go to Start, Administrative Tools, then Services.
  2. Right click on service name World Wide Web Publishing Service, Select Properties, then select the Log On tab.
  3. The username next to this account is the web service account ID. If any other user than IUSR is listed, continue to step 4. If the service account IUSR is used to run the service, this is not a finding.
  4. Open a command prompt and enter Net User [service account ID], press Enter.
  5. Verify the values for Password last set and Password expires to ensure the password has been changed in the past year, and will be required to change within the coming year.

Configure the service account ID, used to run the web-site, to have its password changed at least annually or use the service account IUSR.

There are no specific implementation details and it seems like guidance carried over from earlier versions of IIS. IUSR is not available for selection as a "log on as" service account for the World Wide Web Publishing Service and attempts to change the account have failed. ("Error 1079: The account specified for this service is different from the account specified for other services running in the process.") An attempt to use the same account for the Windows Process Activation Service and the World Wide Web Publishing Service also failed ("Error 1068: The dependency service or group failed to start.")

I'm admittedly not an IIS 7 expert, so if anyone has step-by-step instructions for accomplishing this, I'd appreciate the help. Let me know if I've left out any necessary information. Thanks!

Improve this question
1
  • This security requirement was incorrectly worded and was corrected in a later version of the STIG. If you're looking at this requirement, then make sure you're using the latest version. If you're running the service as Local System, you're fine.
    – user3271228
    Commented Jan 15, 2015 at 20:05

1 Answer 1

Reset to default
3

We have a security requirement for IIS 7 (Windows 2008R2) that reads as follows:

I am sorry you are saddled with this highly questionable policy. It's a lot of operational bother and risk of downtime for very little security win. Service passwords are subject to different risks and limitations to user passwords, it's not appropriate to apply user-password controls like rotation requirements to them.

IUSR is not available for selection as a "log on as" service account for the World Wide Web Publishing Service

You shouldn't touch the WWWPS's WinNT-Service account at all, I don't know where this approach has come from. The service will need to remain root (LocalSystem) so it can impersonate the accounts that the application pools are running under.

Setting service users for the apps themselves should be done by setting the application pools, usually to a built-in user such as the default ApplicationPoolIdentity (but don't use LocalSystem!). Unless it needs to access network resources in which case you will need a domain service account, and then you will need to check the password that service account is using if it is subject to a horrible password rotation policy.

Improve this answer
1
  • It turns out the requirement was incorrect in the revision we were provided. Your comment gives a nice, concise reason for WWWPS to remain as LocalSystem, though.
    – user3271228
    Commented Jan 26, 2015 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .