Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been in the process of updating our web servers recently to use domain accounts for IIS Application Pool identities. I know with IIS7 Microsoft created the idea of the ApplicationPoolIdentity user that creates virtual users, but this doesn't suffice my needs well enough

I changed the user of 'Application Pool #1' from NetworkService to DOMAIN\username and supplied the appropriate password. Upon visiting the hosted website, I received the following error:

System.Security.SecurityException: Request for the permission of type 'System.Web.AspNetHostingPermission, System, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089′ failed.

What I can't understand, is when I switched the account from DOMAIN\username to DOMAIN\DomainAdminUsername the site started right back up and worked just fine. The only difference that I'm aware of between the two accounts is the one is in the Domain Admin membership group in group policy.

What user permissions would I have to provide to DOMAIN\username in order for that user to not receive the exception method above?

share|improve this question

migrated from Jan 5 '12 at 12:51

This question came from our site for computer enthusiasts and power users.

up vote 1 down vote accepted

Does DOMAIN\Username have the permission to run as a service on the server?

share|improve this answer
it's possible that it does not, but I do not believe my DOMAIN\DomainAdminUsername does either, I will check and get back to you – Anthony Shaw Jan 5 '12 at 16:01
The current right is 'Log on as a service', the Domain\Username did not have the permission, but neither did my Domain\DomainAdminUsername. Giving this permission to Domain\Username did resolve the issue tho. Must be domain admins have this right as well I would guess. Thanks for your help! – Anthony Shaw Jan 5 '12 at 16:21
Good article describing how to assign these permissions: – Anthony Shaw Jan 5 '12 at 16:23
It's not necessary anymore to give the application pool account the right to "Log on as a batch job". IIS 6 had a special group defined called IIS_WPG which had all appropriate rights. Just adding your account to that group is enough. In IIS 7 this group is replaced by IIS_IUSRS and IIS will automatically add the application pool account to that group upon launching the application pool (unless you explicitly disable that feature). See also: Understanding Built-In User and Group Accounts in IIS 7 – Marco Miltenburg Jan 5 '12 at 21:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.