I am setting up a web server and notice out the box it gives IIS_IUSRS read & execute (and as a result list folder contents) permissions on the wwwroot. I'm trying to make sure its secure as possible, and just wondering if its ok to leave that?

On my last server (Win2003) I only gave 'read' permissions to users on the wwwroot and then manually added the write / execute permissions on folders as needed.

Just wondering if everyone else leaves the permissions as they are?


You can go through the article http://learn.iis.net/page.aspx/140/understanding-the-built-in-user-and-group-accounts-in-iis-70/. As TomTom said, yes security has changed a lot from what it was in IIS 6.0. The article gives good in-depth on the User and Group level changes that has happened in IIS 7.0.

Below is part from the Web site link and from the help available in IIS 7.

IIS_IUSRS group has been granted access on all the necessary file and system resources so that an account, when added to this group, can act as an application pool identity seamlessly. By default, the ApplicationPoolIdentity account is selected. The ApplicationPoolIdentity account is dynamically created when an application pool is started, and therefore this account provides the most security for your applications.


Here's my understanding:

According to here:

IIS 7 also makes the process of configuring an application pool identity and making all necessary changes easier. When IIS starts a worker process, it needs to create a token that the process will use. When this token is created, IIS 7 automatically adds the IIS_IUSRS membership to the worker processes token at runtime. The accounts that run as 'application pool identities' no longer need to be an explicit part of the IIS_IUSRS group. This change helps you to set up your systems with fewer obstacles and makes your overall experience more favorable.

So, it could be said no matter which account we use as a Application Pool Identity, this account will be given the IIS_IUSRS group permission at runtime dynamically and implicitly. This so-called convenience is claimed to provide the most security. Anyway, who doesn't want IIS_IUSRS permissions if the account is running as an Application Pool Identity. But I just like everything to be in the sun.


  • 1
    If you don't like it: turn on manualGroupMembership :) – TristanK Mar 17 '11 at 4:08
  • Thanks for reminding~ now I have one more thing to take care of... >_< – smwikipedia Mar 17 '11 at 5:05

I suggest y oureally read up on the permission handling in IIS 7 - it is TOTALLY different from the one you know. Totally ;)

I normally set up: * One user for every website * One application pool fo revery website, runing under the user identity * That is it - rights go to the application user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.