4

When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose?

From what I have read the ApplicationPool runs under NetworkService permissions, but I noticed if I gave Portal user full permissions I could do the saving I wanted in the virtual folder without needing to impersonate any other user (I used to impersonate admin which was a bad idea). So I guess my question is, should I be setting permissions on this Portal user without knowing how it came about?

enter image description here

It seems that this user did not get created when I created the website, but did so when I published to the website from VS 2010.

1 Answer 1

1

In IIS 7.5 the default behavior is to run all application pools under a specific account for the individual application. You can of course change this if you modify the application pool settings.

Regardless, yes, setting permissions against this user is the desired behavior as it limits the potential attack surface rather than using a generic network service account as in the past.

You can read more about the change to default accounts in IIS here.

5
  • Please see my edit, it seems the new user was created on a publish from VS 2010. So I am confused. Is it related to VS, so that its easy for VS to publish using this, or is it related to the website itself.
    – sprocket12
    Dec 19, 2012 at 14:57
  • The application pool says "ApplicationPoolIdentity" as its identity. You can see why I am confused. BTW I read the whole article you linked to and it didn't clear anything up.
    – sprocket12
    Dec 19, 2012 at 15:04
  • If the pool is using the ApplicationPoolIdentity account it is in fact working as I mention above. The article linked provides details about how the Virtual Accounts work in IIS, the Portal user account is a function of the Virtual Account being setup for your application. Dec 19, 2012 at 15:07
  • In that article "IIS AppPool\DefaultAppPool" or "IIS AppPool\Portal" never show up (yep I did select the computer itself). But yes okay Ill assume its all good.
    – sprocket12
    Dec 19, 2012 at 15:16
  • Sorry to bother you but the website loses all the set permissions for "Portal" after every publish. It gets set to only "read" access. I thought you may have seen this before, any ideas?
    – sprocket12
    Dec 20, 2012 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .