Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the vein of this question.

Other questions have touched on this, but let's get a complete answer down:

  1. What specific permissions are necessary for a generic IIS 7 site with a domain user as the app pool identity?

  2. What specific permissions are necessary for an ASP.NET IIS 7 site with a domain user as the app pool identity?

  3. Are there any tricks/shortcuts to applying these permissions?
share|improve this question
up vote 11 down vote accepted

If you set your website's anonymous authentication settings to use the app pool identity then you only need to grant the app pool identity access, unless you have a section of the site that doesn't use anonymous authentication, in which case you need to also grant the authenticated users access. I recommend that configuration. It's refreshing to not have to manage an app pool identity account plus an anonymous account.

If you aren't writing to disk, just list/read is all that is needed. If you need to write anything to disk then you'll need to grant write permissions too.

For #3, if it's just 1 server, you can do it from IIS Manager and NTFS permissions. If you plan to script this for multiple servers, let us know and we can provide further details.

share|improve this answer
Thanks for the answer Scott. Are you saying that all you have to do for IIS 7 is add the user as the APP Pool ID? There's no "Logon as service" or similar requirements? Granting it access to the metabase or anything else that aspnet_regiis -ga does for IIS 6? – sh-beta Jan 8 '10 at 19:52
Nope, not anymore. With IIS6 you had to add to the IIS_WPG group, which took care of all of those permissions, but with IIS7, the identity user is automatically added to the IIS_WPG group in real-time. So, just add the user to the app pool settings, grant it access to disk and you'll be set. – Scott Forsyth - MVP Jan 9 '10 at 16:09
@Scott Forsyth: I did that (created a user, even added it to IIS_USERS, gave permissions on the folder, and set the app pool), and I'm getting security exceptions. When I set the app-pool to NetworkService everything works, but I want each of the sites hosted on the server with an isolated user account. Any idea? IIS7.5 btw – Ken Egozi May 10 '10 at 15:29
Ken, the best isolation is to give each site their own app pool, then grant permissions for the app pool. If you use ApplicationPoolIdentity, you can assign the app pool permissions on disk. The user looks like this: IIS AppPool\{apppool name}. – Scott Forsyth - MVP May 13 '10 at 3:12
The identity of application pool APP is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon... – Triynko Jan 27 '11 at 17:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.