Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get pass-through Windows authentication working for a .NET app.

It is running in classic mode on IIS7, and under the Authentication settings in IIS I have Windows Authentication enabled and everything else disabled (including Anonymous Authentication).

To get started, in the web.config I simply have:

<authentication mode="Windows" />
    <allow users="*" />

As I understand it, this means that the website process should be running as the app pool's identity. Users log on using their Windows identity.

What I am finding though is that only users with read access to the website folder are allowed to access the website. Why is this? I thought that because the process is using the app pool's identity it should not matter what credentials the user has.

Am I doing something wrong or misunderstanding something?

share|improve this question
up vote 1 down vote accepted

Any code running in the application pool will run using that identity and not the authenticated user's, but the IIS server will use the passed through authentication to verify that the user actually has access to the files served from the directory and to set ownership on new files created by that user.

Any back-end database access through e.g. .net code would happen under the app pool though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.