Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Situation:

  • test website created in IIS server manager
    • basic settings/connect as: Application user
    • authentication/anonymous authentication/edit: application pool identity
  • physical path has "IIS AppPool\DefaultAppPool" read and execute, list folder contents and read permissions (plus administrators/system with inherited full control)
    • contains a single file, index.html (plus generated web.config with the above settings)

Errors:

  • HTTP Error 500.19 - Internal Server Error
  • Config Error Cannot read configuration file due to insufficient permissions

Questions:

  • how do I make it work with app identity? (got it to work using using iusr both under anonymous auth and with rx permission on the physical folder)
  • am I doing it wrong or this is indeed the best practice as most resources I've found seem to suggest?

I'd also really appreciate any good tutorials on the "basics" of IIS 7.5 - I have been unable to find answers to this specific questions on learn.iis.net and several other sites and generally found the resources available there very fragmented.

Related: IIS 7.5 web site directory permisions, Windows Server 2008 R2 - IIS7.5 - Web site permissions

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

If you've created the website using the usual IIS7.5 out-of-the-box defaults then your "test website" will have had an application pool created for it as well.

The default identity that the site will execute requests as is ApplicationPoolIdentity. ApplicationPoolIdentity is a special synthesised account that is created on the fly and represents the identity of your site's application pool.

You state:

physical path has "IIS AppPool\DefaultAppPool" read and execute

This would explain why you're getting the 500.19 error. Unless you assigned the site to the "DefaultAppPool" application pool this permission won't be doing anything useful.

You need to assign the ApplicationPoolIdentity of the site (at least) read and execute permissions. To do this execute the following from the command line:

icacls <path_to_site> /grant "IIS APPPOOL\<app_pool_name>"(CI)(OI)(M)

Where <app_pool_name> is the name of the application pool that was created for your test site. You can find its name by executing:

appcmd list app /site.name:"<your site name>"

This will return something like and displays the name of your site's application pool (which ApplicationPoolIdentity is named after:

APP "test site/" (applicationPool:test site)
share|improve this answer
    
I was indeed using ASP.NET v4.0 application pool, and using IIS APPPOOL\ASP.NET v4.0 did the trick - had no idea it was a "dynamic" user name. tyvm, do you happen to know of a good tutorial site where I can read more about IIS basics? –  Razor Jan 5 '12 at 14:17
    
@Razor - Glad that helped :). iis.net is as good as any but does assume some basic familiarity with IIS configuration. I'd recommend grabbing a copy of the Microsoft IIS 7 Resource kit book which would give you a good grounding to build from and makes navigating the iis.net reference material a bit easier. –  Kev Jan 5 '12 at 14:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.