Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We know that Microsoft IIS 7.0 offer a slew of authentication methods such as Anonymous Authentication, Form Based Authentication, Digest Authentication, etc.

I read from Professional IIS 7 published by Wrox that:

When we use Anonymous Authentication, the end-user does not supply credentials, effectively mak- ing an anonymous request. IIS 7.0 impersonates a fixed user account when attempting to process the request (for example, to read the file off the hard disk).

So, what is the fixed user account impersonated by IIS? Where can I see it? If I don't know what this account is, how could I assign proper permissions for the clients who are authenticated as anonymous users?


share|improve this question
BTW, I have made my determination to plough my road through the IIS security configurations today, couple of questions may follow. :) – smwikipedia Mar 15 '11 at 7:09

The account is IUSR. Here is a great link describing what the account is and how to grant access.

Here's the key exerpt:

Note: The IUSR account is similar to LOCALSERVICE in the manner in which it acts anonymously on the network. The NETWORKSERVICE and LOCALSYSTEM accounts can act as the machine identity, but the IUSR account cannot because it would require an elevation of user rights. If you need the anonymous account to have rights on the network, you must create a new user account and set the user name and password manually, as you did in the past for anonymous authentication.

To grant an anonymous account rights on the network by using IIS Manager:

  1. Click Start, type INetMgr.exe, and then click Enter. If prompted, click Continue to elevate your permissions.
  2. In the Connections section, click the + button next to the name of your computer.
  3. In IIS Manager, double-click the site that you want to administer.
  4. In the Features View, double-click Authentication.
  5. Select Anonymous Authentication, and then click Edit in the Actions pane.
  6. In the Edit Anonymous Authentication Credentials dialog box, click the Specific user option, and then click Set.
  7. In the Set Credentials dialog box, input the user name and password desired, and then click OK.

Conceptually speaking, IUSR is restricted to a system managed (including password) local only account. You can grant it rights locally by referencing "IUSR" but if you need any more you'll have to create a specific account.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.