We have a security requirement for IIS 7 (Windows 2008R2) that reads as follows:
The service account ID used to run the web site must have its password changed at least annually.
- Go to Start, Administrative Tools, then Services.
- Right click on service name World Wide Web Publishing Service, Select Properties, then select the Log On tab.
- The username next to this account is the web service account ID. If any other user than IUSR is listed, continue to step 4. If the service account IUSR is used to run the service, this is not a finding.
- Open a command prompt and enter Net User [service account ID], press Enter.
- Verify the values for Password last set and Password expires to ensure the password has been changed in the past year, and will be required to change within the coming year.
Configure the service account ID, used to run the web-site, to have its password changed at least annually or use the service account IUSR.
There are no specific implementation details and it seems like guidance carried over from earlier versions of IIS. IUSR is not available for selection as a "log on as" service account for the World Wide Web Publishing Service and attempts to change the account have failed. ("Error 1079: The account specified for this service is different from the account specified for other services running in the process.") An attempt to use the same account for the Windows Process Activation Service and the World Wide Web Publishing Service also failed ("Error 1068: The dependency service or group failed to start.")
I'm admittedly not an IIS 7 expert, so if anyone has step-by-step instructions for accomplishing this, I'd appreciate the help. Let me know if I've left out any necessary information. Thanks!