10

Ok. Here we are trying to set up a Classic ASP website at IIS 7.5 in Windows Server 2008 R2. There is a folder named dbc under the website's root and it has a file which is used to read and write certain information while every page is processed.

The issue is, if I grant IUSR Write Permissions, and IIS_IUSRS Write Permissions, or DefaultAppPool Write Permissions, I get the "Access to the path 'E:..\websiteroot\dbc\filename.txt' is denied"

But If I grant EVERYONE Write access on that dbc folder, then I don't get any error, everything seems perfect.

More Info: The website runs in Classic Pipeline mode, Anonymous Authentication is Enabled (perhaps it's the only authentication enabled).. And I tried Anonymous authentication using IUSR account as well as, Application Pool Identity. In my case, ApplicationPoolIdentity is the Identity for the Authentication of the website. We use a COM+ for file I/O. And Classic ASP Server.CreateObject to instantiate an object out of it. The COM+ runs as a Network Service.

Thoughts? I don't want to grant Write permission to EVERYONE. Am I missing something?

SOLVED: Here's what I did.

My website named CipherDemo was running under an AppPoolIdentity in IIS 7.5, that could be located by the Identity IIS AppPool\CipherDemo. I used ICACLS to give RW permissions on that folder.

and the COM+ that was actually doing the file I/O was running under the Network Service Identity. When I was using Process Monitor to trace the Access Denied Error, it turned that Network Service has only a Read permission on that folder.

I used ICACLS "foldername" /grant:r "NT AUTHORITY\NETWORKSERVICE":(OI)(CI)RXW /T to grant Write access on that folder.

And solved it.

I was on an intention that since the website runs as CipherDemo Identity, this will be the account that will be used to access the file via COM+. But it's embarrassing to find out that the COM+ would still work on it's own Identity boundaries.

3 Answers 3

5

Under IIS 7.5 (and optionally in IIS 7) all workers run with Application Pool Identity: user "IIS AppPool*PoolName*".

Grant access to that user rather than Everyone (you'll need to type the name into the select identity dialogues—it won't show up in the find function).

There is a very useful page on iis.net that covers things in much more detail.

Also note: under IIS7 (Server 2008):

  • You set app pool identity on a per-app pool basis in the advanced settings.
  • There is no GUI support, so you'll need the command line to set permissions (icacls.exe).

Finally SQL Server's identity selection doesn't know about app pool identity either: use CREATE LOGIN and CREATE USER initially, after this the GUI can be used to grant roles etc.

6
  • @Richard - Yes. Thanks for the speedy response. msdn forums are very unuseful these days. Comin back... I have been bugging around the IIS.net website and the serverfault for couple of days. I use the default Application pool identity in my IIS 7.5/ Win server 2008 R2. And so, I have granted the IIS APPPOOL\DefaultAppPool Wite permissions on my 'dbc' folder. Plus I have granted IUSR and IIS_IUSRS Write permissions on that folder. It still would not work utill i give EVERYONE Write permissions. I know there is something that I am missing.. Can you help?
    – gmaran23
    May 16, 2011 at 8:05
  • @gmaran23: If the obvious steps haven't work I use Process Monitor to see exactly what is failing (and often it will be either the open file is asking for too much access, I've failed to set the ACL correctly, or something else has the file open).
    – Richard
    May 16, 2011 at 8:36
  • @Richard - I do Read/Write operations with a file reader in c# with FileMode.Open, FileAccess.ReadWrite. - I guess that part is good. Something else has the file open - I guess this could be ruled out, because no possibilities of it.. There's something wrong with the ACL. I will check that and post it here. Also will try the Process Monitor. Thanks for the assistance :)
    – gmaran23
    May 16, 2011 at 8:59
  • @gmaran23: If it isn't working don't assume you know anything always test. I've wasted too much time over the years because I know something was or wasn't true -- all too often I was wrong.
    – Richard
    May 16, 2011 at 9:02
  • 1
    @gmaran23: Use tools to see exactly what is going on: you're guessing and not working through the issues systematically. (1) Use Process Explorer to confirm the file is not open. (2) Use Process Monitor to see what access is being requested and by what identity (and you have the right file). (3) Double check result of #2 against the ACL on the file (and open the advanced security properties for full details). (4) Adjust one thing and go to #1 until fixed. If you are still stuck after a few iterations expand the Q with full details (and be specific).
    – Richard
    May 16, 2011 at 10:07
5

You can add the account through the NTFS GUI by typing it in directly. The name is in the format of IIS APPPOOL\<<app pool name>>, e.g. IIS APPPOOL\DefaultAppPool. (see this Microsoft support article)

An alternative solution: I've been using the "Network Service" account as application pool user granting it write permission.

1
  • Correct, That tip is good, but I did that already. I use the default "ApplicationPoolIdentity" for the application pool. And for the folder 'dbc' I have already granted Write permissions for IIS AppPool\DefaultAppPool. But it still would not work untill I give EVERYONE Write permission.
    – gmaran23
    May 16, 2011 at 7:12
1

If you want only grant the folder WRITE permission to the specific user, you should also change 'Anonymous user identity' of site to the 'Specific User', not 'Application pool identity'.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .