85

I'm trying to test my ASP.Net website on localhost and I'm getting this error:

HTTP Error 401.3 - Unauthorized
You do not have permission to view this directory or page because of
the access control list (ACL) configuration or encryption settings for
this resource on the Web server.

I have the following users on the website application folder, with full read/write permissions:

  • NETWORK SERVICE
  • IIS_IUSRS
  • SYSTEM
  • Administrators
  • Nathan (me)

What can I try to fix this?

Improve this question
1
  • I've been chasing this issue for a couple of hours now. I already has IUSR and Server\IUSR will the Read permission. Mine problem turned out to be encrypted folders that were extracted from a Zip file. If the folder name are green, try removing the checkbox from the Advanced settings of the Property box. This fixed my issue.
    – Lionel Morrison
    Dec 6, 2014 at 2:30

11 Answers 11

Reset to default
127

IIS 7 also creates "IUSR" as default user to access files via IIS. So make user IUSR has read access to files/folders.

How to check if IUSR has read Access? Right Click -> Folder -> Properties -> Security Tab See if IUSR is in Group or user names list, If No.

Click Edit -> Add -> Advanced -> Find Now -> Select IUSR and click OK four times

Improve this answer
4
  • 5
    Make sure you're searching from the right location. I was searching for IUSR on my work domain and finding nothing. Then I changed the location to my machine name.
    – Mike Blandford
    Apr 8, 2011 at 14:50
  • 8
    Note: It required both IUSR and IIS_IUSRS having access for it to work on my machine. I tried removing IIS_IUSRS after adding IUSR, thinking IUSR was all I needed, but it croaked.
    – kdawg
    Apr 12, 2012 at 22:36
  • 2
    It surprised me that just adding IIS_IUSRs wasn't enough; I also had to add IUSR. Worth remembering :o)
    – Owen Blacker
    Mar 17, 2013 at 0:21
  • Surely the IUSR user is already a member of IIS_IUSRS by default? My server doesn't seem to mention IUSR on it's default permissions set for wwwroot.
    – NickG
    Jul 11, 2014 at 13:01
33

Found this on another forum, so I cant take credit but i did it and it worked for me:

"Try changing the Anonymous authentication setting in IIS7:

Click on Authentication and click edit after choosing Anonymous Authentication. In the opening window select Application Pool identity and click OK. "

Improve this answer
5
  • 5
    This is what did it for me.
    – Chris Marisic
    Sep 29, 2010 at 20:48
  • I am using impersonation and this somehow was the issue. Not sure why, but it worked!
    – Jarrod
    Jul 25, 2013 at 14:54
  • This stopped me from tearing out all my hair today. Thank you.
    – pauska
    Dec 18, 2013 at 16:14
  • On IIS 8.5, it seems that the default for a new application is not to use the Application Pool Identity, but just IUSR. Seems like a bit gotcha to me!
    – Pathogen
    Apr 6, 2017 at 22:54
  • Guess it kind of makes sense to want separate identities for "user running the app pool", and "user impersonated by app pool after 'anonymous' authentication" - but only with hindsight, and after finding this answer!
    – shambulator
    May 12, 2017 at 13:10
23

I had the same issue in IIS 7.5 on Windows Server 2008. For me, the following steps worked to fix the issue:

  • Open IIS Manager
  • Click the website you want to edit
  • Double-click Authentication
  • Click Anonymous Authentication, then click Edit... under Actions
  • Change to use the Application pool identity credentials instead of the Specific user (mine was IUSR)

After I made this change, my 401.3 errors disappeared.

Improve this answer
1
  • Believe it or not, it's 2020 and I'm still maintaining an ancient IIS7.5 server. This post was pretty helpful.
    – CreativeNotice
    Nov 13, 2020 at 22:13
10

Are you using a login mechanism, or just anonymous auth?

If anonymous, go into IIS manager, in the Authentication icon, choose the Anonymous Auth name, then click the Edit button in Actions. Check which user is specified there and make sure it has permissions to the site files/folders.

If you have some form of login system, make sure that the user(s) you are logging in as have permissions to the files for the site, and make sure that the ID of the application pool you are running under has at least read access to the files.

Improve this answer
3

By default, with IIS 7.5, the each Application Pool runs under its own "virtual identity". The App Pool's identity is are the credentials that are used to access the file system.

I'm not sure of the mechanics of it, but Microsoft did this to increase the security of the default install while alleviating the need to create service accounts in certain installation scenarios. Regardless, the upshot is you will have to identify this "virtual identity" account and grant it access to your directory, or change the App Pool's service account.

The App Pool virtual identities are named "IIS AppPool\", so if you are using the DefaultAppPool, its identity would be "IIS AppPool\DefaultAppPool".

See this article for more complete details.

Improve this answer
3

Hi For Me on IIS 8 work : 1)Go on IIS virtual directory - 2)authentication - 3)Anonymous authentication - 4) set Application Pool Identity .

Improve this answer
1
  • Both the IUSR answer and this answer are required for a complete solution in all the cases I've run into
    – Brian Knoblauch
    Jan 4, 2017 at 19:22
2

As none of the answers above helped me I thought I'd share how I solved this issue as I bumped into it on my local machine running win7 and IIS7.

  • Go to IIS7 -> Application Pools

    Find the application pool of your site (in my case DefaultAppPool), right click and choose Advanced Options.

    Find chapter Process Model and change the field Identity to a user you know for sure has access to the files in your website folder (in my case the local admin)

Improve this answer
2

Answering to include info from the comments on the accepted answer.

In IIS 7.5 on Windows Server 2008r2, the IIS_IUSRS group is already included, but the separate IUSR group must still be added to permissions to allow for file access/download.

For more information on the differences in the accounts see Understanding Built-in User and Group Accounts in IIS.

Improve this answer
1

Try this... Go to Computer Management (right click on my computer and select Manage) --> Local Users and Groups --> Users --> Select IUSR_MACHINENAME --> Right click Properties --> Make sure it is a member of IIS_WPG and users and not Guests.

I am working with Server 2008 R2 and the IUser account is not available in the list.

Improve this answer
1

Try installing the client side of IIS using aspnet_regiis -c and then reset IIS.

Improve this answer
1

For users where this isn't quite enough:

I got it to work with this:

  • Open the Feature View of your website.
  • Go to Handler Mappings.
  • Find the path for .cshtml
  • Right Click and Click Edit Feature Permissions
  • Select Execute
  • Hit OK.

Now try refreshing your website.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .