Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am running a web application with default permissions. My application pool is using ‘ApplicationPoolIdentity’ which I believe is a virtual account. In task manager, I can see that w3wp.exe shows the user as ‘DefaultAppPool_classic’ which is the name of my application pool.

This default permission allows my ISAPI application to create folders and files, read and delete files which is exactly what my application needs to do.

I am concerned with security. For example, my CSS and JS folder permissions should not allow anyone, not even my application to do anything other than read.

Since I am using a virtual identity, I can’t just go into the security tab and limit CSS folder permissions to Read only.

I'd really like to hear your comments and/or suggestions.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

There's a few ways to address this, but my preferred method is by not running the application pool under a generic account.

You can change the application pool by going to:

  • Application Pools
  • Advanced Settings
  • Process Model > Identity
  • ...
  • Custom Account > Set

enter image description here

Then set your permissions as you see fit.

share|improve this answer
Hi Mark, thank you for answering my question. This does make sense to me but I wonder why MS chose to use the generic account and why finding documentation on this is not readily available. I've read alot of messages where others are also confused. Can you tell me why this is your preferred method of setting permissions and what you think of the default method? Thanks again. –  Caroline Beltran Jun 10 '14 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.