Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I configured the 'XXXWeb' user that it doesn't have write permissions in the web directory.

To my surprise, I saw that the user could write a logfile in a directory where the 'XXXWeb' user doesn't have any rights. I checked using Process Monitor and I saw that the 'WriteFile' operation was executed with 'XXXWeb' privilege and it succeeded. When I try to write the exact same file when I logged on as 'XXXWeb' it fails.

Does anyone know what could be wrong? I don't want the AppPool to have write rights to prevent security issues, when my IIS is getting hacked for some reason.

share|improve this question
    
I ran into a similar issue on win 2008. Under authentication, Anonymous Authentication for the website, it was set to IUsr. Maybe try changing that to App Pool Identity. –  lucuma May 26 at 22:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.