Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a very simple site with only static files in IIS 7 on Windows Server 2008 SP2.

When I try to access any static file I get a 500 error. If I rename an html file to have an aspx extension it works fine.

The site also works fine when using the built in identity for the application pool. The problem occurs when I switch to using a custom account for the application pool. I have tried using both local and domain accounts to run the application pool under.

I have given full control to these accounts on the website directory and files.

Turning on tracing reveals this error message:
ModuleName: IIS Web Core
Notification: 2
HttpStatus: 500
HttpReason: Internal Server Error
HttpSubStatus: 0
ErrorCode: 2147943746
ErrorCode: Either a required impersonation level was not provided, or the provided impersonation level is invalid. (0x80070542)

I have not had any luck with googling the error code.

share|improve this question
up vote 4 down vote accepted

Prolem Solved: The IIS_IUSRS group was missing from the "impersonate a client after authentication" in the local security policy.

share|improve this answer

you can try to change application pool for this virtual application and give for this new pool personal permissions

to give permissions for specific pool just give permissions for user "IIS APPPOOL\YOUR_POOL_NAME"

share|improve this answer

In addition to Brownie's answer (it is correct, you have to give this right to the app pool account); if IIS sends you this error when you call it using a WCF client (+ Windows-authentication is enabled in IIS), it may be because the flags of the NTLM token given to IIS does not allow it to impersonate the caller.

Modify the config of your client from this (the default):

<behavior name="NewBehavior">
    <windows allowedImpersonationLevel="Identification" />

To this:

<behavior name="NewBehavior">
    <windows allowedImpersonationLevel="Impersonation" />

Check this article for details: Impersonation and Delegation in WCF

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.