I am running a web application with default permissions. My application pool is using ‘ApplicationPoolIdentity’ which I believe is a virtual account. In task manager, I can see that w3wp.exe shows the user as ‘DefaultAppPool_classic’ which is the name of my application pool.
This default permission allows my ISAPI application to create folders and files, read and delete files which is exactly what my application needs to do.
I am concerned with security. For example, my CSS and JS folder permissions should not allow anyone, not even my application to do anything other than read.
Since I am using a virtual identity, I can’t just go into the security tab and limit CSS folder permissions to Read only.
I'd really like to hear your comments and/or suggestions.