Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Windows 2008 R2 I am able to set NTFS permissions for an application pool's synthesised ApplicationPoolIdentity account thus:

ICACLS d:\websites\site1\www /grant "IIS AppPool\site1":(CI)(OI)(M)

The website's application pool is named site1 and is configured to run as ApplicationPoolIdentity. The site's authentication is also configured to authenticate as ApplicationPoolIdentity. I've done this a thousand times on Windows 2008 Standard Edition R2 with never a hitch.

However if I try to do the same in Windows 2008 Standard Edition SP2 I get the error:

IIS AppPool\site1: No mapping between account names and security IDs was done.
Successfully processed 0 files; Failed processing 1 files

I also notice that this fails if I try to set permissions for the application pool identity via the security GUI as well. I've seen this before and a reboot has cleared this issue but I'd like to know why this happens periodically. Googling around suggests other folks have hit this problem but there's never a satisfactory explanation.

Why would this be?

share|improve this question
up vote 2 down vote accepted

Hey Kevin. The windows service used for the virtual mapping is "Application Host Helper Service" (AppHostSvc). Double check that it's running correctly, and since the problem resolves itself after a reboot, next time restart just that service and see if it temporarily resolves the issue.

It sounds like you know, but in pre-R2 you can add the user from the command line only, but then you can 'manage' it from the security GUI (as long as everything is working as it should). In R2 you can also add it in the GUI by typing in the full name (i.e. IIS AppPool\site1).

share|improve this answer
Hi Scott...thanks for the reply. The AppHostSvc was running, I restarted it which cleared the problem. I was vaguely aware that there was this subtle difference between 2008R1 and 2008 R2 and wasn't sure if this was the security GUI misbehaving on 2008R1...thanks for confirming that it's by-design. at least now I have somewhere to start looking when/if this problem happens again. – Kev Jan 6 '11 at 15:14

I tested this on another Windows 2008 Standard Edition SP2 server (the above mentioned server's base image) and couldn't reproduce the error.

I restarted the server and the problem magically cured itself (again). I think I'll be raising a trouble ticket with MS PSS tomorrow.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.