I have a new windows 2008 R2 configuration and I just published a web site to it. I set it to an application pool that uses this identity: ApplicationPoolIdentity and played around with the NTFS permissions giving IIS_IUSRS read access, and it still let the web site create files. So I tried removing even their read access, and they can still open pages on the site.

What am I missing here? How can I lock the permissions down in windows 2008 (IIS 7.5) to only allow users to write to specific folders and only read specific folders?

I really don't want to have to create a local account and give my app pool that account to use...


There is never any need to be granting the IIS_IUSRS group permissions to your public facing web folders. You should be granting rights to the identity that the site is running under, in this case ApplicationPoolIdentity.

I suspect the problem here is that the Users group has write access to these folders. An ApplicationPoolIdentity account is always a member of the Users group.

Strip back the permissions on your web folders to just SYSTEM and Administrators then set the requisite permissions needed for your site to the ApplicationPoolIdentity account.

To set permissions your can use ICACLS.EXE or the GUI. For example, I have the Nerd Dinner MVC site installed on my machine:

`ICACLS c:\NerdDinner /grant "IIS AppPool\NerdDinner":(CI)(OI)(R)

Via explorer:

enter image description here

enter image description here

You won't be able to browse the ApplicationPoolIdentity using the GUI or user manager because it's a synthetic account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy