Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my website's application pool, the identity is set to "ApplicationPoolIdentity". Normally I would use "Network Service" and give read/modify rights to "Network Service" on the website file system. However, someone told me to use "ApplicationPoolIdentity" instead because the site will have their self contained permissions (so one site cannot update files of another when all under "Network Service").

What NTFS user should I use for providing read/modify permissions to a website's "ApplicationPoolIdentity" though?

share|improve this question
up vote 1 down vote accepted
IIS AppPool\AppPoolName

Note that this might not be GUI-selectable or GUI-resolvable in the Object Picker with Windows 2008 (as opposed to R2), but should work from a command line, for eg, with ICACLS or similar.

share|improve this answer
Yes, you will need to use ICACLS on 2008. Also, you can continue to use "Network Service" as you always have, you just need to enable the Medium Trust level for ASP in IIS. That will only allow apps to work within their specific Virtual Directory. – Tatas Jul 8 '11 at 15:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.