Granting permissions to Application Pool Identity's via the UI on Windows 2008R2 can be a bit prone to not working now and again, but can be achieved using a couple of command line tools.
NTFS Permissions:
Use the ICACLS
command line tool to set NTFS permissions:
icacls c:\wwwroot /grant "IIS AppPool\DefaultAppPool":(CI)(OI)(M)
The above configures the DefaultAppPool
identity to have Modify permissions on c:\wwwroot
with File and Folder inheritance. In the UI it looks like:
and under the permissions Advanced UI:
DCOM Launch and Activation and Access Permissions:
Again, the UI can be a bit hinky here when it comes to IIS AppPool\<ident>
accounts and there's no built-in command line tool to configure Launch and Activation Permissions and Access Permissions. You could try setting these values in the registry but unless you know how to create a serialised ACL for LaunchPermission
and AccessPermission
it's going to be hard going.
All is not lost though. There's a tool called dcomperm.exe
which is included as a sample project in the Microsoft Windows SDK for Windows 7 and .NET Framework 4.
This chap has written about it here:
Another step closer to the 100% scripted SharePoint installation with DcomPerm.exe
You can try and build it yourself or download a prebuilt binary from his Microsoft Live SkyDrive.
To use dcomperm.exe
it you'll need to know the AppID
of your DCOM app. You can do this by locating it in the General tab of your application's DCOM configuration properties. For example, I've picked the IIS CertObj library as a working example.:
You can place your cursor in the Application ID field and select the whole field, make sure you include the curly braces as well.
Next open a command line prompt (running as Administrator). To grant your application pool identity Local Launch and Local Activation permissions you would execute:
DComPerm.exe -al {62B8CCBE-5A45-4372-8C4A-6A87DD3EDD60} set "IIS AppPool\DefaultAppPool" permit level:ll,la
Where:
-al
= Modify or list the launch and activation permission
{62B8CCBE-5A45-4372-8C4A-6A87DD3EDD60}
= the App ID we copied from the DCOMCNFG UI
set "IIS AppPool\DefaultAppPool"
= set this identity
permit
= set the permit flag
ll
= Local Launch
la
= Local Activation
This looks like the following in the UI: