Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose?

From what I have read the ApplicationPool runs under NetworkService permissions, but I noticed if I gave Portal user full permissions I could do the saving I wanted in the virtual folder without needing to impersonate any other user (I used to impersonate admin which was a bad idea). So I guess my question is, should I be setting permissions on this Portal user without knowing how it came about?

enter image description here

It seems that this user did not get created when I created the website, but did so when I published to the website from VS 2010.

share|improve this question
up vote 1 down vote accepted

In IIS 7.5 the default behavior is to run all application pools under a specific account for the individual application. You can of course change this if you modify the application pool settings.

Regardless, yes, setting permissions against this user is the desired behavior as it limits the potential attack surface rather than using a generic network service account as in the past.

You can read more about the change to default accounts in IIS here.

share|improve this answer
Please see my edit, it seems the new user was created on a publish from VS 2010. So I am confused. Is it related to VS, so that its easy for VS to publish using this, or is it related to the website itself. – لَا إِلٰهَ إِلَّا الله Dec 19 '12 at 14:57
The application pool says "ApplicationPoolIdentity" as its identity. You can see why I am confused. BTW I read the whole article you linked to and it didn't clear anything up. – لَا إِلٰهَ إِلَّا الله Dec 19 '12 at 15:04
If the pool is using the ApplicationPoolIdentity account it is in fact working as I mention above. The article linked provides details about how the Virtual Accounts work in IIS, the Portal user account is a function of the Virtual Account being setup for your application. – Brent Pabst Dec 19 '12 at 15:07
In that article "IIS AppPool\DefaultAppPool" or "IIS AppPool\Portal" never show up (yep I did select the computer itself). But yes okay Ill assume its all good. – لَا إِلٰهَ إِلَّا الله Dec 19 '12 at 15:16
Sorry to bother you but the website loses all the set permissions for "Portal" after every publish. It gets set to only "read" access. I thought you may have seen this before, any ideas? – لَا إِلٰهَ إِلَّا الله Dec 20 '12 at 9:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.