419

We have recently upgraded to IIS7 as a core web server and I need an overview in terms of the permissions. Previously, when needing to write to the file system I would have give the AppPool user (Network Service) access to the directory or file.

In IIS7 I see, as default, the AppPool user is set to ApplicationPoolIdentity. So when I check the task-manager, I see that a user account called WebSite.example is running the IIS Process ('Website.example' being the name of the website in IIS)

However this user account doesn't exist if I try to use that to give permissions. So, how do I determine which user to give the permissions too?

See below for the problem in screen shot. Our website (www.silverchip.co.uk) runs on the username SilverChip.co.uk. However when I add permissions, this user doesn't exist!

See AppPool Image:

1

8 Answers 8

790

ApplicationPoolIdentity is actually the best practice to use in IIS7+. It is a dynamically created, unprivileged account. To add file system security for a particular application pool see IIS.net's "Application Pool Identities". The quick version:

If the application pool is named "DefaultAppPool" (just replace this text below if it is named differently)

  1. Open Windows Explorer
  2. Select a file or directory.
  3. Right click the file and select "Properties"
  4. Select the "Security" tab
  5. Click the "Edit" and then "Add" button
  6. Click the "Locations" button and make sure you select the local machine. (Not the Windows domain if the server belongs to one.)
  7. Enter "IIS AppPool\DefaultAppPool" in the "Enter the object names to select:" text box. (Don't forget to change "DefaultAppPool" here to whatever you named your application pool.)
  8. Click the "Check Names" button and click "OK".
20
  • 13
    @Pino: No, not the web site name. Use the application pool name. Each web site is assigned to an application pool. You can tell which one on the web site's properties Basic Settings dialog (in IIS7).
    – Jon Adams
    Sep 8, 2011 at 15:04
  • 2
    @Pino: In that case, the security role you should use is IIS AppPool\silverchip.co.uk. I haven't tried periods in security names though--you may want to change it to something without punctuation.
    – Jon Adams
    Sep 8, 2011 at 16:59
  • 11
    I have followed you instructions as you've said. But there is one hack. You have to set property enable load user profile to true in application pool settings. And only after this setting I was able to run application. So please update your instructions and add 9th point.
    – Johnny_D
    Oct 1, 2013 at 12:56
  • 21
    Remember to check that the server settings for anonymous authentication is also using the Application pool identity. This solution worked for me as soon as I switched back from IUSR.
    – bblue
    May 9, 2014 at 23:49
  • 13
    Pay attention here ! You cannot look up the user using the Userinterface, but you have to type it in. Checking the name is the only thing you can do.
    – Remco
    Jan 14, 2015 at 16:34
110

Remember to use the server's local name, not the domain name, when resolving the name

IIS AppPool\DefaultAppPool

(just a reminder because this tripped me up for a bit):enter image description here

10
  • 1
    Yep, I forget this every time, thanks for the reminder James Toomey!
    – tjans
    Sep 28, 2018 at 13:18
  • so from where we can find out local server name
    – user889030
    Jun 26, 2020 at 17:10
  • @user889030, you can either type hostname on the command line, or right-click the My Computer icon in File Explorer and select Properties, and it should list it there. Jul 1, 2020 at 0:09
  • @JamesToomey ya right i have uninstalled IIS because it have issues with exe opening , i was not able to open system browser like chrome firefox etc from it , was getting some cache type error , i think IIS move exe to its sandbox before lunching , so i switched to apache which do not have such issues
    – user889030
    Jul 1, 2020 at 5:05
  • @JamesToomey can u verify that if browsers can be lunched from IIS -> php or not like executing commands like cmd /c start chrome /new-window www.google.com or executing chrome bin with path
    – user889030
    Jul 1, 2020 at 5:07
38

Giving access to the IIS AppPool\YourAppPoolName user may be not enough with IIS default configurations.

In my case, I still had the error HTTP Error 401.3 - Unauthorized after adding the AppPool user and it was fixed only after adding permissions to the IUSR user.

This is necessary because, by default, Anonymous access is done using the IUSR. You can set another specific user, the Application Pool or continue using the IUSR, but don't forget to set the appropriate permissions.

authentication tab

Credits to this answer: HTTP Error 401.3 - Unauthorized

5
  • 4
    This is crucial!!! Must change the "Anonymous Authentication" to "Application pool identity" for security! I'm sure there's a good reason it's set to IUSR, but I can't think of a single one. Thanks!!!
    – Danimal111
    Dec 16, 2016 at 16:57
  • This has fixed the issue for me. It might be because my version of IIS is 8 on Windows Server 2012 R2
    – myroslav
    May 25, 2017 at 20:59
  • 4
    This is an important step that should be added to the accepted answer. Also the simplest way is to change the radio box to Application pool identity
    – Sourcery
    Feb 14, 2018 at 9:46
  • 2
    This was my problem! Thank you!! May 31, 2018 at 23:45
  • 2
    I love that, 6 years later, you still just solved my problem. #legacy Aug 15, 2022 at 4:02
31

On Windows Server 2008(r2) you can't assign an application pool identity to a folder through Properties->Security. You can do it through an admin command prompt using the following though:

icacls "c:\yourdirectory" /t /grant "IIS AppPool\DefaultAppPool":(R)
6
  • 1
    can you explain this a little? What does (R) mean? Do you actually enter angle brackets in this command? Jun 23, 2014 at 22:34
  • 3
    Hi Kate, I was using <> to denote "your apppool name here", but left in a legitimate apppool name. In IIS Manager -> Application Pools you'll need to match the name, spaces included. The last one I did was "IIS AppPool\ClientName_CompanyName - Intranet". :(R) in this case is granting read access. You can also use F (full), M (modify), RX (read+execute) and W (write only).
    – Chris
    Jun 30, 2014 at 12:59
  • 10
    You can actually assign via the Securities tab in Properties in Windows Server 2008 R2 so you shouldn't need this workaround. Make sure you have built-in security principals selected on object types and location.
    – rism
    Jul 30, 2014 at 9:57
  • This answer works for me.The selected answer doesn't work for me. Oct 31, 2014 at 14:59
  • 3
    see also the original response of the select answer of [link]serverfault.com/questions/81165/… For plain Windows Server 2008 (or Datacenter edition) you pretty much have to use the command line to get the app pool account into the security dialog. Once it's there, you can manage it, change permission levels, for subdirectories etc. Also consider: "icacls "c:\yourdirectory" /t /grant "IIS AppPool\DefaultAppPool":(OI)(CI)(R)" OI-object inheritance, CI-container inheritance.
    – secretwep
    Jul 3, 2015 at 21:19
15

Part A: Configuring your Application Pool

Suppose the Application Pool is named 'MyPool' Go to 'Advanced Settings' of the Application Pool from the IIS Manager

  1. Scroll down to 'Identity'. Trying to edit the value will bring up a dialog box. Select 'Built-In account' and under it, select 'ApplicationPoolIdentity'.

  2. A few lines below 'Identity', you should find 'Load User Profile'. This value should be set to 'True'.

Part B: Configuring your website

  1. Website Name: SiteName (just an example)
  2. Physical Path: C:\Whatever (just an example)
  3. Connect as... : Application User (pass-through authentication) (The above settings can be found in 'Basic Settings' of the site in the IIS Manager)
  4. After configuring the basic settings, look for the 'Authentication' configuration under 'IIS' in the main console of the site. Open it. You should see an option for 'Anonymous Authentication'. Make sure it is enabled. Then right click and 'Edit...' it. Select 'Application Pool Identity'.

Part C: Configuring your folder

The folder in question is C:\Whatever

  1. Go to Properties - Sharing - Advanced Sharing - Permissions, and tick 'Share this folder'
  2. In the same dialog box, you will find a button 'Permissions'. Click it.
  3. A new dialog box will open. Click 'Add'.
  4. A new dialog box 'Select Users or Groups' will open. Under 'From this location' make sure the name is the same as your local host computer. Then, under 'Enter the object names', type 'IIS AppPool\MyPool' and click 'Check Names' and then 'Ok'
  5. Give full sharing permissions for 'MyPool' user. Apply it and close the folder properties
  6. Open folder properties again. This time, go to Security - Advanced - Permission, and click Add. There will be an option 'Select a Principal' at the top, or some other option to choose a user. Click it.
  7. The 'Select Users or Groups' dialog box will open again. Repeat step 4.
  8. Give all or as many permissions you need to the 'MyPool' user.
  9. Check 'Replace all child object permissions..." and Apply and close.

You should now be able to use the browse the website

3
  • You are king of the jungle! Thank you
    – tno2007
    Mar 30, 2020 at 17:17
  • 1
    why "share" the folder? No need to "share" it. This is a security risk, Just change the permissions under the "Security" tab.
    – goofology
    Aug 18, 2020 at 19:59
  • The IIS AppPool\MyAppPool is what I needed. Thank you! Nov 2, 2020 at 19:39
7

Top Answer from Jon Adams

Here is how to implement this for the PowerShell folks

$IncommingPath = "F:\WebContent"
$Acl = Get-Acl $IncommingPath
$Ar = New-Object  system.security.accesscontrol.filesystemaccessrule("IIS AppPool\DefaultAppPool","FullControl","ContainerInherit, ObjectInherit", "None", "Allow")
$Acl.SetAccessRule($Ar)
Set-Acl $IncommingPath $Acl
1
  • Adding full control to the physical path of the website opens up a vector of attack for files to be altered or created by the web application. I would recommend only granting Read & Execute. Only allow specific sub folders to be explicitly written to, even better don't write files to the physical path of the web site ever.
    – Adam Carr
    Jan 6, 2022 at 19:52
1

Just to add to the confusion, the (Windows Explorer) Effective Permissions dialog doesn't work for these logins. I have a site "Umbo4" using pass-through authentication, and looked at the user's Effective Permissions in the site root folder. The Check Names test resolved the name "IIS AppPool\Umbo4", but the Effective Permissions shows that the user had no permissions at all on the folder (all checkboxes unchecked).

I then excluded this user from the folder explicitly, using the Explorer Security tab. This resulted in the site failing with a HTTP 500.19 error, as expected. The Effective Permissions however looked exactly as before.

1

I fixed all my asp.net problems simply by creating a new user called IUSER with a password and added it the Network Service and User Groups. Then create all your virtual sites and applications set authentication to IUSER with its password.. set high level file access to include IUSER and BAM it fixed at least 3-4 issues including this one..

Dave

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.