Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When creating a new website on a production windows 2008 r2 server which requires connection to SQL Express should I create a custom identity for the application to run under or leave it as NetworkService?

I see that that the IIS application pool advanced settings dialog box recommends that Network Service should be used which is fine but if that is considered the best practice how should I configure the application to connect to a local SQL server Express DB?

If I use Integrated Security to connect to the DB then I need to create a login for NT AUTHORITY\NETWORK SERVICE which doesn't feel correct as I may have other websites hosted using different local DB's. So should I create a SQL account for each website which require DB access then set the username and password in the web config? If that is the best way should I, or can I, encrypt the password in the web config file?

I've been searching on here and I can't seem to find a definitive view. My searches for the relevant info on MSDN/TECHNET and IIS.NET don't seem to be that fruitful so if anyone can link best practices/reference material it would be greatly appreciated.

share|improve this question

migrated from Mar 12 '12 at 23:07

This question came from our site for professional and enthusiast programmers.

Off Topic for Stack Overflow. Try Server Fault – Kyle Trauberman Mar 12 '12 at 23:00
I suggested dba.stackexchange as opposed to serverfault. – Aaron Bertrand Mar 12 '12 at 23:02
@MPD this appears to be multiple questions. Are you concerned more about the DB user connection, or the application execution side? – Joshua Drake Apr 10 '12 at 14:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.