The day started off so well, then about halfway through took the biggest nosedive in the world.

I’m working on building up a new corporate web server at work to replace the existing site and server with. It’s a Windows 2003 box that it took me like three days just to build and secure (it was locked down, man) and get so it could be remotely administered from our corporate network yet not be a threat if it was compromised. It was solid.

Well, we put some security patches on it that came out recently and the web server portion of the machine started denying everyone access to the site. I mean, not even ask you for username and password - just straight up denying you access.

After fucking around with it for like two hours, I come to find out that it’s a sort of “intelligence” that’s been built into the system.

For the technical: The machine was a domain controller (on its own domain) with a one-way trust between our corporate domain and itself. The machine also ran IIS for the web site stuff. It turns out the security patches we did (or something related, though I couldn’t say what) made it so that only Administrators were allowed to log on locally to the box. Even if the Domain Controller Security Policy said otherwise. Even if everything else - all other policies and settings - said otherwise. It just wouldn’t let anyone in. That includes the IUSR_MACHINENAME anonymous user account. Which means you can’t run an anonymously accessed web site on a domain controller - even if you want to - unless the anonymous user account is a local administrator. Fucking brilliance.

For the non-technical: Microsoft decided to make things more “secure” by not allowing you to “accidentally” do certain things. Even if you specifically want to do those things.

Thank you very much, Microsoft.

So now I have to build up a whole new domain controller machine and a whole new web server, reconfigure and re-secure both machines, reinstall the web site (thankfully written in ASP.NET so it’s easy to deploy), and hopefully be back at square one by the end of next week.

Bah. How irritating is that?!