Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to test my ASP.Net website on localhost and I'm getting this error:

HTTP Error 401.3 - Unauthorized
You do not have permission to view this directory or page because of
the access control list (ACL) configuration or encryption settings for
this resource on the Web server.

I have the following users on the website application folder, with full read/write permissions:

  • NETWORK SERVICE
  • IIS_IUSRS
  • SYSTEM
  • Administrators
  • Nathan (me)

What can I try to fix this?

share|improve this question
    
I've been chasing this issue for a couple of hours now. I already has IUSR and Server\IUSR will the Read permission. Mine problem turned out to be encrypted folders that were extracted from a Zip file. If the folder name are green, try removing the checkbox from the Advanced settings of the Property box. This fixed my issue. –  Lionel Morrison Dec 6 at 2:30

10 Answers 10

up vote 72 down vote accepted

IIS 7 also creates "IUSR" as default user to access files via IIS. So make user IUSR has read access to files/folders.

How to check if IUSR has read Access? Right Click -> Folder -> Properties -> Security Tab See if IUSR is in Group or user names list, If No.

Click Edit -> Add -> Advanced -> Find Now -> Select IUSR and click OK four times

share|improve this answer
    
Thanks, that did it. –  Nathan Ridley Jul 17 '10 at 20:12
4  
Make sure you're searching from the right location. I was searching for IUSR on my work domain and finding nothing. Then I changed the location to my machine name. –  Mike Blandford Apr 8 '11 at 14:50
4  
Note: It required both IUSR and IIS_IUSRS having access for it to work on my machine. I tried removing IIS_IUSRS after adding IUSR, thinking IUSR was all I needed, but it croaked. –  kdawg Apr 12 '12 at 22:36
    
It surprised me that just adding IIS_IUSRs wasn't enough; I also had to add IUSR. Worth remembering :o) –  Owen Blacker Mar 17 '13 at 0:21
    
Surely the IUSR user is already a member of IIS_IUSRS by default? My server doesn't seem to mention IUSR on it's default permissions set for wwwroot. –  NickG Jul 11 at 13:01

Found this on another forum, so I cant take credit but i did it and it worked for me:

"Try changing the Anonymous authentication setting in IIS7:

Click on Authentication and click edit after choosing Anonymous Authentication. In the opening window select Application Pool identity and click OK. "

share|improve this answer
2  
This is what did it for me. –  Chris Marisic Sep 29 '10 at 20:48
    
I am using impersonation and this somehow was the issue. Not sure why, but it worked! –  Jarrod Jul 25 '13 at 14:54
    
This stopped me from tearing out all my hair today. Thank you. –  pauska Dec 18 '13 at 16:14

Are you using a login mechanism, or just anonymous auth?

If anonymous, go into IIS manager, in the Authentication icon, choose the Anonymous Auth name, then click the Edit button in Actions. Check which user is specified there and make sure it has permissions to the site files/folders.

If you have some form of login system, make sure that the user(s) you are logging in as have permissions to the files for the site, and make sure that the ID of the application pool you are running under has at least read access to the files.

share|improve this answer

I had the same issue in IIS 7.5 on Windows Server 2008. For me, the following steps worked to fix the issue:

  • Open IIS Manager
  • Click the website you want to edit
  • Double-click Authentication
  • Click Anonymous Authentication, then click Edit... under Actions
  • Change to use the Application pool identity credentials instead of the Specific user (mine was IUSR)

After I made this change, my 401.3 errors disappeared.

share|improve this answer

As none of the answers above helped me I thought I'd share how I solved this issue as I bumped into it on my local machine running win7 and IIS7.

  • Go to IIS7 -> Application Pools

    Find the application pool of your site (in my case DefaultAppPool), right click and choose Advanced Options.

    Find chapter Process Model and change the field Identity to a user you know for sure has access to the files in your website folder (in my case the local admin)

share|improve this answer

By default, with IIS 7.5, the each Application Pool runs under its own "virtual identity". The App Pool's identity is are the credentials that are used to access the file system.

I'm not sure of the mechanics of it, but Microsoft did this to increase the security of the default install while alleviating the need to create service accounts in certain installation scenarios. Regardless, the upshot is you will have to identify this "virtual identity" account and grant it access to your directory, or change the App Pool's service account.

The App Pool virtual identities are named "IIS AppPool\", so if you are using the DefaultAppPool, its identity would be "IIS AppPool\DefaultAppPool".

See this article for more complete details.

share|improve this answer

Try this... Go to Computer Management (right click on my computer and select Manage) --> Local Users and Groups --> Users --> Select IUSR_MACHINENAME --> Right click Properties --> Make sure it is a member of IIS_WPG and users and not Guests.


I am working with Server 2008 R2 and the IUser account is not available in the list.

share|improve this answer

Try installing the client side of IIS using aspnet_regiis -c and then reset IIS.

share|improve this answer

For users where this isn't quite enough:

I got it to work with this:

  • Open the Feature View of your website.
  • Go to Handler Mappings.
  • Find the path for .cshtml
  • Right Click and Click Edit Feature Permissions
  • Select Execute
  • Hit OK.

Now try refreshing your website.

share|improve this answer

Hi For Me on IIS 8 work : 1)Go on IIS virtual directory - 2)authentication - 3)Anonymous authentication - 4) set Application Pool Identity .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.