Suggestions for Limited Admin Rights

sprkymrk

Hi All:
I am looking for ideas/suggestions for a situation here. I have a guy who is a developer (sort of) and I need to set up a Development Web Server for him to try his stuff on before moving it to our production server. It will be W2K3/IIS6. I am curious as to what kind of rights I should give this guy based on the following info:

1. He has no networking experience. 2. He has no administrative experience. 3. He has no server configuration or IIS experience. 4. He has limited Help Desk experience and just barely passed the first half of his A+ a few weeks ago. 5. He is fairly intelligent and a decent database/developer/asp guy. 6. He will eventually be our Webmaster (scarey I know - not my decision). 7. I need to enable him to not only upload and test his web apps (which would be easy just give him rights to the necessary directories) but also to tweak and modify the IIS settings to test and trouble shoot said web stuff.

I am hesitant to make him a full admin on the web server, even if it is only a development server. Does anyone have any suggestions as to how I can give him enough rights to play with IIS without giving him full admin rights? Thanks!

agustinchernitsky

7. I need to enable him to not only upload and test his web apps (which would be easy just give him rights to the necessary directories) but also to tweak and modify the IIS settings to test and trouble shoot said web stuff.

Well, the normal procedure would be "configure it once, and leave it alone". You can't give this man admin rights on a web server.... besides, imagine all the security risks that would imply.

Just give him access to the website root folder... nothing more.

Maybe for obs 7, you can be arround him helping him configure the web server... at least until he gets his hands on it.

If you still want to do it... -> http://support.microsoft.com/default.aspx?scid=kb;EN-US;q298969

sprkymrk

Excellent, thank you agustinchernitsky, that's what I was looking for.

sprkymrk

Oops, that only applies to IIS4 and IIS5. There is no "Operators" tab in II6.

agustinchernitsky

let me check this in my virtual server... there must be a way!

agustinchernitsky

Well,

There no "supported solution" by MS... but, If you want to play arround,

check: http://msmvps.com/blogs/bernard/archive/2005/05/08/46074.aspx

Good luck amigo.[/quote]

RussS

Simple answer ... install a trial version on a workstation and let him rip.


Oh, and have a ghost image so you can rebuild it in a flash

strauchr

There is no real issue with giving a developer admin rights to a development server - it is a very common done thing.

But as RussS says, have an image of the server so you can rebuild it and theres not problem with 'experimenting'. Make sure you quarentine this server in case it has adverse effects on the production environment. Once it goes production it sounds like he will need admin rights if he will be the webmaster anyway.

blargoe

There wouldn't be a clean way to give him admin rights to only IIS. If you don't mind doing the IIS admin stuff like creating virtual directories, permissions, restarting the web site, etc, you can give him the rights to update content fairly easily.

sprkymrk

agustinchernitsky wrote:

Well,

There no "supported solution" by MS... but, If you want to play arround,

check: http://msmvps.com/blogs/bernard/archive/2005/05/08/46074.aspx

Good luck amigo.

Thanks, that looks promising.

RussS wrote:

Simple answer ... install a trial version on a workstation and let him rip.

This is what we currently do, but we need a little closer emulation to the real thing. Stuff like SSL, certificates, other users as testers, etc. Policy prohibits sharing and running a web server from a work station.

stauchr wrote:

There is no real issue with giving a developer admin rights to a development server - it is a very common done thing.

I might have to go this route, but would like to avoid it if possible.

blargoe wrote:

If you don't mind doing the IIS admin stuff like creating virtual directories, permissions, restarting the web site, etc, you can give him the rights to update content fairly easily.

This is how it's currently done on the production web server, which is fine. I'd like to avoid the extra work on the development server. This particular guy can be a pain sometimes.

Thanks everyone for the replies and ideas. I'll post back in a couple of weeks on the final implementation.