What's Wrong With This Code? (#7)

It should be <deny users="*" /> the ? just denies anoymous users.

Based on the snippet, I would probably say the BUILTIN\Administrators seems to be the culprit. The user would have to be an admin on the box the web application is hosted on in order to gain access to the secure directory.

This will essentially allow everyone EXCEPT anonymous users... so if some other user from another group authenticates, it will allow them to see the path.

It should be deny users="*"

yes he should,
any one that is authenticate will get access to adminPages he should change to:
<allow roles="BUILTIN\Administrators" />
<deny users="*" />

Maybe <deny users="*" /> ?

Everyone who is authorized will have access to the adminPages. Only the anonymous users will get blocked.

Every rule gets evaluated in order and only if there is a match the rule will get applied and no further rules will get evaluated.

Since only BUILYIN\Administrators and ? are address, a random authorized user will fall thorug the rules and default to getting access.

To achieve what was set the second rule should be deny users="*"

Authorized users have an access.
Replace "?" with "*".

Although this configuration denies anonymous users, he needs to remember that other users who have successfully been authenticated will still be given access.

The following needs to be added underneath the <deny...> element:

<deny users="*" />

Yep, he should be worried!

I'd try using the following in the web.config that resides in the "adminPages" directory.

<configuration>
<system.web>
<authorization>
<allow roles="BUILTIN\Administrators" />
<deny users="*" />
</authorization>
</system.web>
</configuration>

As many pointed out, the config file will need to add:

<deny users="*" />

to prevent other authenticated users.

@Tyrone: Since this is an intranet app, presumably someone can login on another machine with domain credentials that give them admin access on this box.

Scott,

Looks like I misread the question. I can't see how I missed the "should only be accessible to users in the machine's local administrators group" in the second sentence. Anyways, waiting for #8.