Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I often need to give write permissions on a folder or a file for ASP.NET applications deployed in different environments.

In which case is it better/required to give write permission to NETWORK Service rather than ASPNET user or IIS_WPG ?

share|improve this question

In IIS7 I would set the site's anonymous user to use the app pool identity, then you can assign the app pool's identity user.

In IIS6 I normally recommend setting a custom user for the app pool identity, although if you only have a couple sites on the server which trust each other you can leave it as network service. In IIS6, depending on your impersonation settings, either the app pool identity will be used, or the site's anonymous user account will be used. (by default it's Network Service for the app pool and IUSR_machinename for the anonymous account)

You don't need to assign IIS_WPG permissions to disk at any point since that's the group account that the app pool worker process lives in.

Here's a short video that covers IIS security. It's focused on IIS7, but the concepts are similar.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.