Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've just added a new development server to our office network running Windows Web Server 2008 with IIS7.5 and SQL 2008 R2.

We don't RDP to the server, instead we run IIS Manager and SQL Mgmt Studio remotely and the WWW folder is shared that we have mapped to our computers. Everything is working perfectly apart from one thing.

When we add a new website (and a new app pool is created) we can't set permissions for that new app pool through our shared drive or via RDP. We can see the app pool in IIS though and the super admin for our network can do this without any issues.

User creates a new website/apppool called TEST. In the WWW folder, TEST -> Properties -> Security we try to add IIS AppPool\TEST but it can't find the object. Same thing happens via RDP. User has access to IIS AppPool\DefaultAppPool though.

Super Admin logs in to Dev server and can set permissions for all app pools.

This is quite weird since we're all local admins on the dev box and it's the users creating the AppPools.

Anyone have an idea how to resolve this?


share|improve this question

Sounds about right, if I'm parsing the question correctly, but you say "via RDP" and "not using RDP", which makes it tricky to understand.

If I recall correctly, the "IIS AppPool\" provider is the Application Host Helper service, which runs on the local box.

I don't know if that's remotable, I'd assume not, but if it is remotable via RPC, that might explain why admin man can do it.

share|improve this answer
Well put it this way, the super admin can see ALL app pools, while the local admin can only see the Default ones. Very weird. – Marko Nov 30 '11 at 1:16
The RDP question was the one I was hoping you'd answer. Does it behave correctly when you're logged on to the computer locally (via RDP)? – TristanK Nov 30 '11 at 5:26
no it doesn't. Same results as via IIS Manager unfortunately. We have a production server with a similar set up (except it's not in our corporate domain) and different users can use the app pools to set permissions without any issues. – Marko Nov 30 '11 at 19:50
Well, by examining GPRESULT /Z (from an elevated CMD prompt) on the broken one with the working one, you can hopefully work out which policies are applying that might be interfering with the defaults. For example, permissions/service state forcibly applied to the App Host Helper. – TristanK Dec 1 '11 at 22:14
not sure how I'm meant to use that GPRESULT.. could you provide a little instruction? (Sorry for my lack of knowledge in this area) – Marko Dec 1 '11 at 23:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.