If a web application is set to run using a specific account, could a malicious user do something they shouldn't if I use the "Everyone" account to manage permissions on a folder on the server? The folder is used by that web application to read/write files.

I probably left something out here, so please let me know if you need more info.

  • 2
    What do you mean you use the everyone account to manage permissions? By using it as the only entry in the ACL?
    – Steve
    Nov 5, 2012 at 1:25
  • Not the only entry. I guess I just mean using it at all. Nov 5, 2012 at 15:51

3 Answers 3


I highly recommend against using "everyone" as this grants permissions to users/people/entities who aren't even part of your domain or user base.

A malicious user can only do what your permissions allow (read, write, modify, etc) however, by using "everyone" you are inadvertently granting access to more people than you may realize.

I recommend creating a local users group and populating that local users group with your domain users group. Then grant the local users group permissions to the data.

Also, assuming this is IIS, the account that the application pool runs as and the account the users actually authenticate to the content as are two different things.

  • Interesting point about IIS. How would I find what account a user is actually authenticating to the content as? Nov 5, 2012 at 15:52
  • First you must determine which method the user is utilizing to authenticate. This will help: technet.microsoft.com/en-us/library/cc733010(v=ws.10).aspx If it's an internal application than you will typically want to use NTLM or Kerberos authentication (in which case the users authenticate as themselves) and grant NTFS permission to the webroot according. For an internet facing application you will typically utilize Anonymous authentication in which place the default IUSR account is who the users will masquerade as.
    – k1DBLITZ
    Nov 5, 2012 at 20:13

Given that you are handing over permissions to write files, somebody will have permission to write a file that may be malicious. Also, if sensitive data is stored in the folder, they will be able to read that.


By granting permission to Everyone, you're effectively removing any concept of access control from that file or folder. The implications of this depend primarily on what else happens on your server.

Presumably if you can carefully control all the ways in and all the ways out, then theoretically you can modulate access in such a way as to make file-level permissions unnecessary. But that's quite a gamble.

In fact, part of what you're relying on is not only your own ability to control access to the server, but also the security correctness of every service and every component and every asset associated with the server, which may not even be something you can control. If any component falls to an attack, your permissive permissions may provide the attacker the foothold he needs to leverage access even further and gain greater control over your server.

Removing any layer of security isn't generally considered a good idea. As a rule you want as much security as your usage case will permit, as every little bit helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .