Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am unable to upload files to website hosted under IIS7. I have already given write permissions to "IUSR_websitename" and set the property in web.config also.

I am able to upload files with out log in to application at the time of user registration. But once log in to application, if I upload files, it is giving "Access denied" error.

Please help me.

share|improve this question
I have just set the <identity impersonate="true" /> in web.config. – krish Aug 8 '09 at 18:40
IUSR_ServerName you mean? – Sev Aug 8 '09 at 18:50

It's your app pool identity user that is used for most things on disk. That's Network Service by default. Grant Network Service write permissions to your website path, or change the identity and grant the new user permissions if you want to lock the server down further.

In IIS7, as long as you have 1 site per app pool, in {Site} -> Authentication -> Anonymous, I recommend changing that to use the worker process identity. Then you don't need to worry about the IUSR account anymore.

share|improve this answer

The logged-in user is being impersonated, so that identity will be the one doing the file creation and writing. The ISR_xxx account is being used when anonymous, so that is why that upload is successful.

I'd recommend creating a "File Uploaders" security group and then adding all users that are allowed to upload into it. Give that group create and write permissions to the upload directory and any existing files. And the Creator/Owner may need to have Change/Delete too.

The IUSR_xxx account (or the IUSRS group) may need Read on all uploaded files if they're going to be served to anonymous users.

share|improve this answer
I'd like to add that it is an extremely bad idea (security wise) to give anonymous web users (IUSR_MachineName) write access to anything on the web server. There is no need to hack your site if you leave your keys dangling from the doorknob. – JohnFx Aug 9 '09 at 6:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.