18

I am running Windows 7, and am not usually a developer in this setting, and have recently built a WCF Rest Service in C#, that I'm now trying to deploy to IIS just on my local machine. After much wrangling, I setup up the application, but when I navigate to the application, I get an error message: Compilation Error

Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately.

Compiler Error Message: CS0016: Could not write to output file 'c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\scom_sibyll\8c0b945e\9329016\App_global.asax.eagmqgcd.dll' -- 'Access is denied. '

I have hunted the web to the best of my ability, and have changed the permissions on the Temporary ASP.NET Files fodler to allow the Network Service account full rights, and done the same with the Temp folder. It copies a number of files before failing, so it has write permissions presumably, so I checked the permissions to read from my source folder, and that is working as well. I additionally noted it's crapping out when it tries to to cache the DLL file, and tried turning off my Antivirus protection, as well as turning off UAC, just to see if I could figure out what is blocking this from occurring. I'm fresh out of ideas now. Anybody have any suggestions?

1
  • Make sure that your IIS Identity has the correct permissions on your folders. Commented Mar 14, 2011 at 15:06

14 Answers 14

57

For those looking here as I did, if the accepted answer doesn't resolve the issue you might try following this article: http://lordzoltan.blogspot.com/2011/02/aspnet-2-and-4-default-application-pool.html

In summary, it seems that the same error is sometimes displayed when the app pool user doesn't have access to the %TMP%/%TEMP% folder.

You'll need to grant IIS_IUSRS read and modify access over the temp folder of the user the app pool is running as.

This could either be the temp folder in the app pool user's profile, e.g. c:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp, or the system temp folder at c:\windows\temp.

Setting this up this resolved the issue for me.

5
  • 13
    +1 Granting access to C:\Windows\Temp seemed to fix it for me (despite the error message being to the contrary). Thanks! Commented Oct 27, 2011 at 22:48
  • This solution worked perfectly for me. I had this issue after installing PHP on IIS 7 Commented Sep 5, 2012 at 22:04
  • 1
    +1. I ran into this issue after I was cleaning up many gigs of temp files in C:\Windows\Temp. The command I issued accidentally deleted the Temp folder itself and I had to recreate it. Any custom permissions on it were nuked at that time and then I started getting the error in the original question. Commented Apr 2, 2014 at 19:33
  • Perfect solution, worked for me. Most blogs suggest to change the App Pool Identity to Network User which is dangerous (albeit localhost). Commented Sep 7, 2016 at 21:23
  • Granting access to C:\Windows\Temp to IIS_USRS worked in Server 2016 as well. Thanks!
    – ahwm
    Commented Oct 30, 2016 at 2:31
12

Sounds like the account that the WCF service is running under does not have access to write to the "Temporary ASP.NET Files" directory.

You could also try re-running regiis.

%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis -i

ASP.NET IIS Registration Tool (Aspnet_regiis.exe)

3
  • That is what I would have thought as well, but the WCF service should be running as Network Service by default, right? Is ther ea way to confirm this? I checked the rights for this account. Additionally, I had already tried the aspnet_regiis command, I forgot to mention it, thank you. Any other ideas? Commented Mar 14, 2011 at 15:15
  • 1
    Check which application pool your web app is running in. On the properties form of that application ppol you will be able to see the Identity the pool is running as. Unless, you are using impersonate and IS is configured to use windows authentication. Is there an entry posted to the event log? Does it show which account could not access the folder?
    – MattC
    Commented Mar 14, 2011 at 15:18
  • pERFECT! Thanks, sorry for the newbie question - it was not set to the right user account. Feel stupid now:D Commented Mar 14, 2011 at 15:40
8

On Windows 8/Server 2012 there is no support for aspnet_regiis any more. I tried reinstall using windows features: fail. I tried reinstalling IIS: fail. I tried reinstall through WebPI: fail.

I solved the issue by setting the ACL's on the Windows Temp Directory.

Here is a powershell that does the job:

$dir = "C:\Windows\Temp"
$acl = get-acl -path $dir
$new = "IIS_IUSRS","Modify","ContainerInherit,ObjectInherit","None","Allow"
$accessRule = new-object System.Security.AccessControl.FileSystemAccessRule $new
$acl.SetAccessRule($accessRule)
$acl | Set-Acl $dir
1
  • I think full control is a little too much. Modify is just fine.
    – Carl R
    Commented Dec 1, 2016 at 21:57
5

There're 3 step to do:

1 - check if "Application Pool Identity" is NetworkService

2 - NETWORK_SERVICE account needs full control on:
    . C:\Windows\Temp
    . C:\Windows\Microsoft.NET\Framework[related framework]\Temporary ASP.NET Files\

3 - restart the IIS

Error Solved

You could also try re-running regiis. "%windir%\Microsoft.NET\Framework[related framework]\aspnet_regiis -i"

0
2

This KB resolved it for me, it appears that the temp file path was nonexistent in the OS environmental variables.

http://support.microsoft.com/kb/825791

2
  • 4 hours - and this was the cure! An application had changed the environment variables and cocked it up - cheers fella!
    – Dandymon
    Commented Dec 3, 2014 at 22:17
  • Typing iisreset on command line as suggested in the answer link (after changing permission on temp folders) did the job for me Commented Jun 14, 2016 at 22:41
1

I granted read and write access to C:\Windows\Temp for the IIS_WPG group. This worked for me. I'm on Server 2003 R2 and IIS 6 and the group name is different. I fount it from http://learn.iis.net/page.aspx/140/understanding-built-in-user-and-group-accounts-in-iis/ where it says:

•The IUSR built-in account replaces the IUSR_MachineName account.

•The IIS_IUSRS built-in group replaces the IIS_WPG group.

Thanks to Dommer for suggesting the windows temp folder and to zcrar70 for the nice summery and a link with detailed description.

1

For me the solution was a combination of the fixes described here. I had to give to the NETWORK_SERVICE account full control on

C:\Windows\Temp

and

C:\Windows\Microsoft.NET\Framework[related framework]\Temporary ASP.NET Files\

and also change the Application Pool Identity to NetworkService.

Also do not forget to restart the IIS after you give full control to NETWORK_SERVICE on the Temp folders

1
1

I was getting the same error while developing a web api using asp.net core 2.0 and it got resolved after restarting the machine.

0

Some times the Temp files might be locked by other process in the workstation. As a first step please reboot the workstation and check the application.

0

On Windows 8 absolutely nothing worked for me. One day app pools suddenly decided they no longer want to work under the NetworkService account.

I solved the problem by changing the app pool to work under my own user account. Not a great solution I know, but it worked.

0
0

This error happens when I use a bat file to delete temporary files. It probably deletes the directory itself and the given permissions are gone. So you have to restore them somehow.

The easiest way is to grant full control over following directories for Everyone:

C:\Windows\Temp

C:\Windows\Microsoft.NET\Framework[related framework]\Temporary ASP.NET Files\

0

I have permissions but I'm starting to get that error. "restart machine" works for me

0

I started getting this error too recently in a corporate environment after the company implemented various security measures that took away admin rights from the users.

For developers, the company authorized the creation of accounts that could be used and we had to add these to the PC's admin group and then change the application pool's identity to use the account.

EXAMPLE (Windows 10)

Account created for developers: domain\developer

Someone with admin rights to the PC will have to do the following:

  • Go to Control Panel\User Accounts\Manage User Accounts
  • Click on the Advanced tab, and click on the Advanced user management button
  • In the lusrmgr page, click on the Groups folder in the left column to bring up groups in the center panel
  • Then secondary-click on the Administrators group and select "Add to Group..."
  • In the Administrators Properties panel, click the "Add..." button
  • A "Select Users, Computers, Service Accounts, or Groups" dialog opens. Add the account (domain\developer in this example)
  • Then click on the OK button (this button will be disabled if you don't have admin rights)

Now configure the App Pool:

  • Open IIS Manager, select Application Pools
  • Click on the application pool you want so it's highlighted, then click "Advanced Settings..." from the Actions panel on the right
  • Under the Process Model section, click on the Identity setting and the ellipses button
  • In the Application Pool Identity dialog, select "Custom account" and then click the Set button
  • Enter the account and the password

At this point I was able to close everything, restart IIS and then run my app. It could then access the temp folders it couldn't before.

0

In my case, when I change Load User Profile to True (App Pool -> Advance setting -> Load User Profile -> set to true) it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.