Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to set the IIS account for new websites to have modify permissions. I have the following script:

function Set-ModifyPermission ($directory, $username, $domain = 'IIS APPPOOL') {
    $inherit = []"ContainerInherit, ObjectInherit"
    $propagation = []"None"
    $acl = Get-Acl $directory
    $user = New-Object System.Security.Principal.NTAccount($domain, $username )
    $accessrule = New-Object$user, "Modify", $inherit, $propagation, "Allow")
    set-acl -aclobject $acl $directory

However, when I run it, I get errors like this:

Set-Acl : The trust relationship between this workstation and the primary domain failed.

I think this is because IIS APPPOOL isn't a real domain, but is a weird prefix on a kind-of-fake account. Is there a correct way to refer to that account so that I can make this work?

share|improve this question
up vote 9 down vote accepted

First of all, use Set-Acl like this, as the directory path is the first positional argument:

Set-Acl $directory $acl

Second, you should create the user object with only one argument:

$user = New-Object System.Security.Principal.NTAccount("$domain\\$username")

UPDATE: Seems that it won't accept the "IIS APPPOOL\AppPoolName" as an NTAccount identifier. Now, there are two ways to accomplish what you are trying to do:

  1. Create a new SID object with the AppPoolIdentities SID and translate it into an NTAccount, like this:, and you should be able to treat it like any other NTAccount object. If you still want to be able to pass domain/usernames for real accounts, built in some simple logic that defaults to the AppPool SID if username is "AweSomeAppPool" and domain is empty, just as an example.

  2. Use PowerShell to invoke icacls.exe, and use it to grant/revoke whatever permissions you want, like this (first normal icacls form command prompt, then powershell, notice the difference):

    icacls.exe test.txt /grant "IIS AppPool\DefaultAppPool":(OI)(CI)M

    cmd /c icacls test.txt /grant "IIS AppPool\DefaultAppPool:(OI)(CI)M"

If you go for the second option, be sure to test them manually first, i haven't had a chance to test these specific examples myself, but it should work

share|improve this answer
Thanks for the help. Doing that, I get an exception calling AddAccessRule: "Some or all identity references could not be translated." Any ideas what that might be? – bdukes Dec 27 '11 at 22:59
Try to help me understand what you are trying to accomplish here. The thing is, that ApplicationPoolIdentities aren't "real" NT Accounts, they are more like a "virtual account" representation of the NETWORK SERVICE actually. Do you wan't to set permissions on local system resources or networked resources? Depending on your need, a different challenge arises :-) – Mathias R. Jessen Dec 27 '11 at 23:16
Local system resources. I'm trying to streamline setting/resetting permissions for local development websites that I setup. So, I'd unzip a website package to the file system, set it up in IIS, then run this command to give IIS modify permission. Or, run into a permission issue in the site, run this to make sure something I've added after the site was created has modify permission. – bdukes Dec 29 '11 at 14:52
Just added some hopefully useful options for you – Mathias R. Jessen Dec 29 '11 at 16:52
I was able to get icacls working great for me, thanks for the help! I ended up with the body of the function (same parameters as above) being cmd /c icacls "$directory" /grant ("$domain\$username" + ':(OI)(CI)M') /t /c /q (with /t to work recursively on the directory, /c to keep going after any errors, and /q to suppress success messages for each file). – bdukes Dec 29 '11 at 19:35

Something like this should do the trick for you. It should be able to resolve IIS APPPOOl\Anything as well...

function Set-AclOnPath
        [string] $Path,

        [string] $DomainAccount

    #Put whatever permission you want here
    $permission = $DomainAccount,"ReadAndExecute","Allow"
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission

    $acl = Get-Acl $Path
    $acl | Set-Acl $Path
share|improve this answer
I get an exception calling SetAccessRule: "Some or all identity references could not be translated." – bdukes Sep 19 '12 at 13:58
What were your inputs? – Haytham AbuelFutuh Sep 20 '12 at 21:15
Set-AclOnPath .\Website "IIS APPPOOL\", though when I try it again, I get a different error, "The trust relationship between this workstation and the primary domain failed." – bdukes Sep 21 '12 at 1:59

The following works in Windows 2012 to get a SID for the IIS site. It requires the IIS Provider which uses the WebAdministration powershell module, but this article indicates it will work on Windows 2008R2.

$appPoolName = 'MyAppPool'
$appPoolSid = (Get-ItemProperty IIS:\AppPools\$appPool).applicationPoolSid
$identifier = New-Object System.Security.Principal.SecurityIdentifier $appPoolSid
$user = $identifier.Translate([System.Security.Principal.NTAccount])
share|improve this answer
I tried to use this approach (on Windows 8), but got this error: "Exception calling 'AddAccessRule' with '1' argument(s): 'Some or all identity references could not be translated.'" – bdukes Aug 5 '13 at 17:00
Using the link from @Mathias R. Jessen's answer to translate the SID into a real NTAccount worked. – bdukes Aug 5 '13 at 17:20
I've updated the code in the answer to do the translation. Also, for those trying to take advantage of this, call Import-Module WebAdministration to get the IIS drive from the IIS provider. – bdukes Aug 5 '13 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.