Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having a problem with an identity pool on a new IIS server.

Here's my Event viewer text:

Event Type: Warning
Event Source:   W3SVC
Event Category: None
Event ID:   1021
Date:   	6/12/2009
Time:   	1:44:50 PM
User:   	N/A
Computer:   <scrubbed>
The identity of application pool, '<scrubbed>' is invalid.  If it remains invalid when the first request for the application pool is processed, the application pool will be disabled.  The data field contains the error number.

For more information, see Help and Support Center at
0000: 69 05 07 80               i..?

Google suggests that it's something to do with the user of the app pool which I set in the "Identity" tab. The most common problems are:

  1. Setting the wrong password
  2. Not adding the user to the IIS_WPG group

I've tried and retried both of these (and restarted the IIS service), and nothing seems to be fixing it. What other things should I be looking for.

FWIW, the identity user is a domain (not local) user. This same setup is working fine on another (supposedly identical) server/setup.

share|improve this question
up vote 6 down vote accepted

Thanks to MattB, this Stack Overflow thread eventually led me to the right answer (for me).

I ran the following command (from C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727):

aspnet_regiis.exe -GA domain\username

...where domain\username was the domain-qualified username (in the standard Windows format) of the user I was using for the app pool's identity.

From the aspnet_regiis help, the -GA option does:

Grant the specified user or group access to the IIS
metabase and other directories used by ASP.NET.

I don't know why this wasn't done automatically on this server (as I've never had to do this in the past).

share|improve this answer

A shot in the dark, but perhaps the domain account you've configured for the App Pool's identity is locked?

share|improve this answer
Nope, that wasn't it. Thanks though. – Craig Walker Jun 12 '09 at 20:25

Try giving the account "Logon as a Service" rights as well. Here is a very similar question from stack overflow.

share|improve this answer
It wasn't "Logon as Service", but the Stack Overflow question you linked to gave me the right answer. Thanks! – Craig Walker Jun 12 '09 at 20:25

If you're using IIS6, with the Metabase Explorer (in the resource kit), you can do the following:

  • browse to /LM/W3SVC/AppPools/MyAppPool
  • enable "View/Secure data"
  • (if needed) enable "View/Inherited data"

Now, look at the WAMUserName and WAMUserPass. You can try running processes as that user:

runas /user:myuser cmd.exe

If that does not work, you should be closer to the answer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.