9

I want to reference these links because they highlight my issue

Create SQL Server Login for IIS APPPOOL - IIS and SQL Server on different machines

and

Configuring ASP.NET MVC app's IIS 7.5 Application Pool identity as login on SQL Server 2008 R2.

To summarize the posts, I have ServerA with IIS and my app pool and ServerB with SQL Server. ServerA SQL recognizes my app pool as a login since that is where IIS resides, but now I need my app pool to access SQL on ServerB.

I have tried to create a SQL login on ServerB for my app pool as Domain\ComputerName$\IIS APPPOOL\AppPoolName, but it does not recognize that. It recognized Domain\ComputerName$, but my application still does not work.

Am I on the right track, if so what user name do I specify? My DBA skills are not as sharp as they should be. Thank you.

1 Answer 1

5

I don't think you can use AppPool for remote SQL Server. Give machine account Domain\ComputerName$, access to SQL, or you can run AppPpool with domain user account (domain\username) and give this user access to SQL.

Domain\MachineName$ is more secure and maintainable as you do not have keep updating password for user every n months, and restricts to only one machine. If you have multiple IIS server then you have to go with domain\username method, and set AppPool to use this user account (Windows Auth).

I think You can also create group Domain group and add all (IIS) machine name on this group and give this group permission to SQL.

4
  • after republishing my app I tried the Domain\ComputerName$ again and that worked. Not sure why it did not work the first time (I was actually coming back to my post to update it with my solution and saw you had put what I had done, thanks!). If I had to go down the second solution, how would I do that (I am very new to this part of SQL)? Do you have an example on how to do this?
    – jmzagorski
    Mar 4, 2014 at 17:32
  • Create a Windows Group on SQL SERVER machine. Add all IIS machine name as the user for this group. Remember to add $ at the end. e.g. SqlAccessGroup DOMAN\IISMachine1$ DOMAN\IISMachine2$ DOMAN\IISMachine3$ etc. and then on SQL give SqlAccessGroup permission. Mar 4, 2014 at 17:59
  • If you have 20 applications on one machine and you want to separate their permissions in remote SQL server?
    – user158443
    May 11, 2020 at 12:42
  • "Domain\MachineName$ is more secure and maintainable" is inaccurate. On a machine there can be multiple services running (such as multiple application pools) and many of them might be able to use the machine account to perform database connection. Thus, granting the machine account access to a database instance unnecessarily exposes the data to irrelevant services and raises security risks. The right approach is to use domain managed service account instead, so that each application pool can use a dedicated account, which was introduced in Windows Server 2012 (before this answer was provided).
    – Lex Li
    Jul 19, 2023 at 6:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.