By fsjws4 on

I just installed Drupal on a local development server, under Windows XP and IIS. Everything went smoothly with the install, but I'm getting this error in the status report:

Configuration file Not protected
The directory sites/default is not protected from modifications and poses a security risk. You must change the directory's permissions to be non-writable.

I've checked the folder, and it's marked as Read-Only. All users in the security tab are set to have no write access, and I've restarted IIS after making these changes. No luck, though.

What am I supposed to change to clear this error?

⋅ Categories: Drupal 6.x

Comments

fsjws4’s picture

fsjws4 commented

Aha, I figured it out. Looks like "attrib +R" from the command prompt does the trick. I'm not sure why that's treated differently than the read-only checkbox, but there it is.

kxerc’s picture

kxerc commented

Thanks much fsjws4. Had the same problem on 3 different Win. 2003 Ent. with IIS 6. What is weird is that some fresh installs didn't generate the error. Other fresh installs did. I couldn't find any reason or pattern. I went bald pulling my hair out. Thanks for the solution. I'm not sure if this is an MS problem or Drupal, but either way not terribly fun.

goose2000’s picture

goose2000 commented

Yes this worked for me too on Win 2003 Server. I just did an explorer to the /sites dir and then did a right-click 'command prompt here' and did the deed:

attrib +R default

drupalTone’s picture

drupalTone commented

Though the warning was coming up for the sites\default directory, changing permissions on default had no effect. It was "attrib +R default" on the sites directory that removed the warning.

Thanks fsjws4. Don't know how long this would have taken me to sort out if I hadn't found your post.

Anyone know what effects this may have when Drupal tries to write file sin the site directory in future, or does it use a local IIS account for this?

Thanks agaon,

Tony

beanluc’s picture

beanluc commented

Yes, Drupal uses the local IIS group. The IIS user must be a member of that group.

beanluc’s picture

beanluc commented

This is off the topic of WinXP,
BUT:
To WinServer2008 users who find this thread,
be aware:
attrib +R doesn't work in IIS7. (well, it does work [does what it's supposed to], but it doesn't solve this issue.)
Nobody yet knows how to make this warning go away under IIS 7.

http://drupal.org/node/287276