---
title: Minimal secure configuration
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Your web application should be run with the smallest set of rights that allow the application to function correctly. For example, a web application should NOT have access anywhere outside of the web application space. When attackers happen to find a flaw in the web application, they will not at least gain access to sensitive information stored on the server (e.g., the SAM database, where the user passwords are stored).

You should explicitly ensure that:

- The IIS is run under a custom low-rights user account.
- The IIS application pool is run under a correctly configured user account. It is recommended to create a custom user account with minimum rights. See [Specify an Identity for an Application Pool (IIS 7)](http://technet.microsoft.com/en-us/library/cc771170\(v=ws.10\).aspx).
- The SQL Server Services are run under separate low-rights Windows or Local user accounts. See [Configure Windows Service Accounts and Permissions](http://msdn.microsoft.com/en-us/library/ms143504.aspx).
- Unsafe SQL functions, like xp\_cmdshell(), are not enabled.

## Minimal Kentico requirements

This list provides the minimal configurations for SQL and IIS user accounts in order to work properly with Kentico.

### Minimal configuration for an SQL user account

For **browsing the web**, this account must be:

- granted with permissions **connect**, **insert**, **select**, **execute**, **update**, **delete**\
  OR
- added to the database-level role name **db\_owner**.

For **creating a database**, this account must be:

- granted with permissions **connect**, **insert**, **select**, **execute**, **update**, **delete**, **alter**, **references**\
  OR
- added to the database-level role **db\_owner**.

If you want to limit the permissions for an SQL user, you have to first create a new SQL login in the SQL Management Studio, map it to the database and then assign the permissions for this login. For information about creating logins in SQL Management Studio, see [Create a Login](http://technet.microsoft.com/en-us/library/aa337562.aspx).

### Minimal configuration for an IIS user account to be able to use Kentico:

- this account must be granted with **Read**, **Write**, **Modify** permissions for the website directory.