Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Could someone advise on best practice for setting up the Application Pool Identity for the web service under the following scenario


  1. Web Service requires read/write permission to SQL database
  2. IIS and SQL are on different servers but on the same domain

If ApplicationPoolIdentity is used \$, is added as the SQL user, does this expose our servers to any particular security risks as opposed to adding a new domain user and assigning this user as the application pool identity and giving the user permission on the SQL database?


Same scenario but instead using the NetworkService built-in user as the application pool identity. Again, does this expose our servers to any particular security risks as opposed to adding a new domain user?


share|improve this question

Using the AppPool Identity for a remote SQL server essentially means you're giving the AD computer account for the web server access to the SQL database. Because of that, anything else running on the web server in the context of the computer account also has access to the SQL server. You could do a lot worse in terms of security, but an explicitly defined domain account is definitely better since you can make sure the only code using it is your web site.

If managing a domain based account (and its requisite password) is too much hassle and your web server is running on 2008 R2 or Win7, you might be able to use a Managed Service Account which basically gives you the manageability benefits of the AppPool Identity with the security of a domain account.

I haven't personally gotten the chance to play with managed service accounts yet. So I'm not sure if the TechNet documentation has any gaps or caveats. But it's worth a shot if you've got the time and your environment meets all the requirements. They definitely won't work on your IIS6 box though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.