0

I've been in the process of updating our web servers recently to use domain accounts for IIS Application Pool identities. I know with IIS7 Microsoft created the idea of the ApplicationPoolIdentity user that creates virtual users, but this doesn't suffice my needs well enough

I changed the user of 'Application Pool #1' from NetworkService to DOMAIN\username and supplied the appropriate password. Upon visiting the hosted website, I received the following error:

System.Security.SecurityException: Request for the permission of type 'System.Web.AspNetHostingPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089′ failed.

What I can't understand, is when I switched the account from DOMAIN\username to DOMAIN\DomainAdminUsername the site started right back up and worked just fine. The only difference that I'm aware of between the two accounts is the one is in the Domain Admin membership group in group policy.

What user permissions would I have to provide to DOMAIN\username in order for that user to not receive the exception method above?

1 Answer 1

1

Does DOMAIN\Username have the permission to run as a service on the server?

4
  • it's possible that it does not, but I do not believe my DOMAIN\DomainAdminUsername does either, I will check and get back to you Jan 5, 2012 at 16:01
  • The current right is 'Log on as a service', the Domain\Username did not have the permission, but neither did my Domain\DomainAdminUsername. Giving this permission to Domain\Username did resolve the issue tho. Must be domain admins have this right as well I would guess. Thanks for your help! Jan 5, 2012 at 16:21
  • Good article describing how to assign these permissions: kbase.gfi.com/showarticle.asp?id=KBID003504 Jan 5, 2012 at 16:23
  • It's not necessary anymore to give the application pool account the right to "Log on as a batch job". IIS 6 had a special group defined called IIS_WPG which had all appropriate rights. Just adding your account to that group is enough. In IIS 7 this group is replaced by IIS_IUSRS and IIS will automatically add the application pool account to that group upon launching the application pool (unless you explicitly disable that feature). See also: Understanding Built-In User and Group Accounts in IIS 7 Jan 5, 2012 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .