I want to delegate administration of several Web sites to Web masters, but I don't want to make those Web masters administrators on the IIS server. The Operators tab on the Web site's Properties dialog box seems to serve this purpose, but just which capabilities operators have that administrators don't isn't clear. What are a Web operator's limitations?
When you designate a user as an Operator, you give that user the somewhat limited ability to manage a Web site. An operator can access the properties only of the Web sites to which you've assigned him or her; that operator can't see any other sites in the Microsoft Management Console (MMC) Internet Information Services snap-in. The Operator role is also useful when you're using the Administration Web Site to manage the IIS server.
While reviewing the tasks that Web site operators can perform, I was surprised at how much control they can have. For example, operators can
- configure, enable, and disable logging
- configure authentication
- add and remove Internet Server API (ISAPI) filters
- add and remove application mappings
- configure IP address restrictions
- set up redirection to another URL
They can also perform some less important tasks, such as
- change the default document
- designate a footer
- set content expiration
- enable content ratings
- adjust the Performance Tuning slider on the Performance tab in the Web site's Properties dialog box
Operators don't have the authority to
- create a Web site
- create a virtual directory
- change the means by which a Web site is identified (e.g., IP address, port number, host header)
- configure the identify of the Anonymous account
- throttle bandwidth
- enable process throttling
- create or change the location of virtual directories
- change application-protection modes (i.e., in process, pooled, out of process)
- redirect to a Universal Naming Convention (UNC) pathname
With the ability to configure authentication, ISAPI filters, and application mappings, an operator also has the ability to misconfigure a Web site, rendering it unusable. Consequently, you must ensure that your operators know what they're doing before you grant them such authority.
Before you assign user accounts Operator privileges, consider creating a local group for each Web site (or group of sites) for which you want to delegate administration. Assign the user account (or accounts) to the group. Then, assign the group rather than individual user accounts Operator privileges. In this way, if you want to add, remove, or change operators, you can do so by controlling group membership.