Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm interested in setting up a full-blown local user to run my ASP.NET web sites under in IIS 7.5 (Windows Server 2008 R2).

(The long and boring rationale has to do with System.IO.Packaging's use of Isolated Storage. Running the offending code under another AppDomain using MarshalByRef or serialization isn't really an option.)

I've always used the user defaults for IIS (AppPoolIdentity, Network Service, IUSR, etc.), so I'm looking for advice in how to properly set up a regular user for IIS.

What pitfalls should I look out for, especially around permissions and security?

share|improve this question

1 Answer 1

In IIS7.5, When you create a separate Application Pool for your website a separate User is created automatically. It means different websites have completely different users, so I'm wondering why you may need to assign a regular user? I don't think if it's possible because of many security risks. A regular user has lots of permissions in system and as a result, attacker can do many system calls through your website.

share|improve this answer
    
The question already states why this is needed. This isn't a hosting farm. I was able to easily switch my app pool to the new user, I'm just looking to be sure the default user permissions aren't a problem. Obviously, this user doesn't have remote login privileges or access to unnecessary files. –  richardtallent Oct 24 '12 at 19:48
    
I think they don't recommend this because by the way it gives more power to hackers (at least regular user can read HDD) and if there is a security issue in IIS or Windows, hacker can do system calls through port 80, although user doesn't have remote login privilege. –  Mehdi Oct 24 '12 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.