Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a development machine on Windows 7 with IIS7. These are the steps I have taken:

  • Under the Default website I created a virtual directory called test and mapped it to my D:\testvdir folder (default site is installed on C:\inetpub\wwwroot).
  • I added a html and a simple aspx file to the virtual directory.
  • I did not change the security settings for D:\testvdir or the files inside the folder, when I look the following users/groups are present for the folder as well as teh files: Authenticated Users, SYSTEM, Administrators, Users.

The book I am reading on IIS7 says "When creating a virtual directory to another location on your server or remotely, ensure that the accounts of the site anonymous user (IUSR) and the worker process identity (can be found by looking at the properties of the application pool) have the required permissions to read and execute as required."

This is where I get confused because I can access the content in my virtual directory using localhost/test/default.htm without doing what the book tells me to do.

What am I missing?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

This could be for either of a couple reasons. Check your site's anonymous settings and see if it's set to use the app pool identity. If so, then the IUSR account isn't used. Instead it uses the app pool identity, allowing you to only have to maintain a single account.

The other possibility is that your folder already had access. For example, if "Users" already had read access then your site will likely work.

share|improve this answer
    
No, it is not set to use the app pool identity. The group Users did have access to the the folder so does that explain why? Can you please explain? Does IUSR and the default application pool identity belong to Users? –  Thomas Jan 14 '10 at 17:43
    
Correct, both IUSR and the default app pool are in the Users group. If you remove the users group then the site should fail. Ideally you should remove the users group and then grant just the IUSR and app pool identity so that you're only giving access to what absolutely needs it. –  Scott Forsyth - MVP Jan 14 '10 at 18:34
    
Thank you for that. Now things are making more sense. –  Thomas Jan 15 '10 at 10:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.