Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a server with 60+ sites on it. Right now all those sites are running under the IUSR account. Looking at the folder security the IIS_IUSRS group has access to all the site's folders. This presents a problem in that, if one site is compromised, all sites are compromised as the one user can reach all the files.

Is it possible to setup each site to run under its own user and if so, how do I set up the sites in such a fashion?

I'm running Windows server 2008 R2 Service pack 1 (build 7601) with IIS version 7.5.

share|improve this question
Here's some documentation about authentication.… – Nixphoe Aug 2 '11 at 19:51

Yes, you would create an application pool for each site (and it is likely IIS has already done this for you) and then configure the Identity of each of these pools however you wish.

share|improve this answer

Yes. The default for Windows 2008 R2 - and a feature available in 2008 SP2 - is to run each website using the ApplicationPoolIdentity (a low-privileged automatically generated account). You can also specify that identity as the Anonymous user account.

Each website created through the GUI gets an application pool associated with it, and a low-privileged user account (an App Pool Identity) is sorta inferred sorta generated sorta (the account doesn't actually exist, but a computable SID does) for that app pool when run with that identity.

To isolate your apps better:

  • secure the content of each website so that IUSR doesn't have read, only that (IIS AppPool\AppPoolName) identity (+system+admins+any authenticated users) does

  • edit the Anonymous Authentication settings for each site, and set the Anonymous user to the Application Pool Identity

You're pretty much going to need to do that all at once, so in the future, it's easier to pre-provision them that way. :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.