Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Could someone advise on best practice for setting up the Application Pool Identity for the web service under the following scenario

IIS7.5

  1. Web Service requires read/write permission to SQL database
  2. IIS and SQL are on different servers but on the same domain

If ApplicationPoolIdentity is used \$, is added as the SQL user, does this expose our servers to any particular security risks as opposed to adding a new domain user and assigning this user as the application pool identity and giving the user permission on the SQL database?

IIS6

Same scenario but instead using the NetworkService built-in user as the application pool identity. Again, does this expose our servers to any particular security risks as opposed to adding a new domain user?

Thanks

share|improve this question
add comment

1 Answer

Using the AppPool Identity for a remote SQL server essentially means you're giving the AD computer account for the web server access to the SQL database. Because of that, anything else running on the web server in the context of the computer account also has access to the SQL server. You could do a lot worse in terms of security, but an explicitly defined domain account is definitely better since you can make sure the only code using it is your web site.

If managing a domain based account (and its requisite password) is too much hassle and your web server is running on 2008 R2 or Win7, you might be able to use a Managed Service Account which basically gives you the manageability benefits of the AppPool Identity with the security of a domain account.

I haven't personally gotten the chance to play with managed service accounts yet. So I'm not sure if the TechNet documentation has any gaps or caveats. But it's worth a shot if you've got the time and your environment meets all the requirements. They definitely won't work on your IIS6 box though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.