I'm trying to test my ASP.Net website on localhost and I'm getting this error:

HTTP Error 401.3 - Unauthorized
You do not have permission to view this directory or page because of
the access control list (ACL) configuration or encryption settings for
this resource on the Web server.

I have the following users on the website application folder, with full read/write permissions:

  • NETWORK SERVICE
  • IIS_IUSRS
  • SYSTEM
  • Administrators
  • Nathan (me)

What can I try to fix this?

  • I've been chasing this issue for a couple of hours now. I already has IUSR and Server\IUSR will the Read permission. Mine problem turned out to be encrypted folders that were extracted from a Zip file. If the folder name are green, try removing the checkbox from the Advanced settings of the Property box. This fixed my issue. – Lionel Morrison Dec 6 '14 at 2:30

11 Answers 11

up vote 119 down vote accepted

IIS 7 also creates "IUSR" as default user to access files via IIS. So make user IUSR has read access to files/folders.

How to check if IUSR has read Access? Right Click -> Folder -> Properties -> Security Tab See if IUSR is in Group or user names list, If No.

Click Edit -> Add -> Advanced -> Find Now -> Select IUSR and click OK four times

  • 5
    Make sure you're searching from the right location. I was searching for IUSR on my work domain and finding nothing. Then I changed the location to my machine name. – Mike Blandford Apr 8 '11 at 14:50
  • 8
    Note: It required both IUSR and IIS_IUSRS having access for it to work on my machine. I tried removing IIS_IUSRS after adding IUSR, thinking IUSR was all I needed, but it croaked. – kdawg Apr 12 '12 at 22:36
  • 1
    It surprised me that just adding IIS_IUSRs wasn't enough; I also had to add IUSR. Worth remembering :o) – Owen Blacker Mar 17 '13 at 0:21
  • Surely the IUSR user is already a member of IIS_IUSRS by default? My server doesn't seem to mention IUSR on it's default permissions set for wwwroot. – NickG Jul 11 '14 at 13:01

Found this on another forum, so I cant take credit but i did it and it worked for me:

"Try changing the Anonymous authentication setting in IIS7:

Click on Authentication and click edit after choosing Anonymous Authentication. In the opening window select Application Pool identity and click OK. "

  • 5
    This is what did it for me. – Chris Marisic Sep 29 '10 at 20:48
  • I am using impersonation and this somehow was the issue. Not sure why, but it worked! – Jarrod Jul 25 '13 at 14:54
  • This stopped me from tearing out all my hair today. Thank you. – pauska Dec 18 '13 at 16:14
  • On IIS 8.5, it seems that the default for a new application is not to use the Application Pool Identity, but just IUSR. Seems like a bit gotcha to me! – Pathogen Apr 6 '17 at 22:54
  • Guess it kind of makes sense to want separate identities for "user running the app pool", and "user impersonated by app pool after 'anonymous' authentication" - but only with hindsight, and after finding this answer! – shambulator May 12 '17 at 13:10

I had the same issue in IIS 7.5 on Windows Server 2008. For me, the following steps worked to fix the issue:

  • Open IIS Manager
  • Click the website you want to edit
  • Double-click Authentication
  • Click Anonymous Authentication, then click Edit... under Actions
  • Change to use the Application pool identity credentials instead of the Specific user (mine was IUSR)

After I made this change, my 401.3 errors disappeared.

Are you using a login mechanism, or just anonymous auth?

If anonymous, go into IIS manager, in the Authentication icon, choose the Anonymous Auth name, then click the Edit button in Actions. Check which user is specified there and make sure it has permissions to the site files/folders.

If you have some form of login system, make sure that the user(s) you are logging in as have permissions to the files for the site, and make sure that the ID of the application pool you are running under has at least read access to the files.

By default, with IIS 7.5, the each Application Pool runs under its own "virtual identity". The App Pool's identity is are the credentials that are used to access the file system.

I'm not sure of the mechanics of it, but Microsoft did this to increase the security of the default install while alleviating the need to create service accounts in certain installation scenarios. Regardless, the upshot is you will have to identify this "virtual identity" account and grant it access to your directory, or change the App Pool's service account.

The App Pool virtual identities are named "IIS AppPool\", so if you are using the DefaultAppPool, its identity would be "IIS AppPool\DefaultAppPool".

See this article for more complete details.

Hi For Me on IIS 8 work : 1)Go on IIS virtual directory - 2)authentication - 3)Anonymous authentication - 4) set Application Pool Identity .

  • Both the IUSR answer and this answer are required for a complete solution in all the cases I've run into – Brian Knoblauch Jan 4 '17 at 19:22

As none of the answers above helped me I thought I'd share how I solved this issue as I bumped into it on my local machine running win7 and IIS7.

  • Go to IIS7 -> Application Pools

    Find the application pool of your site (in my case DefaultAppPool), right click and choose Advanced Options.

    Find chapter Process Model and change the field Identity to a user you know for sure has access to the files in your website folder (in my case the local admin)

Answering to include info from the comments on the accepted answer.

In IIS 7.5 on Windows Server 2008r2, the IIS_IUSRS group is already included, but the separate IUSR group must still be added to permissions to allow for file access/download.

For more information on the differences in the accounts see Understanding Built-in User and Group Accounts in IIS.

Try this... Go to Computer Management (right click on my computer and select Manage) --> Local Users and Groups --> Users --> Select IUSR_MACHINENAME --> Right click Properties --> Make sure it is a member of IIS_WPG and users and not Guests.


I am working with Server 2008 R2 and the IUser account is not available in the list.

Try installing the client side of IIS using aspnet_regiis -c and then reset IIS.

For users where this isn't quite enough:

I got it to work with this:

  • Open the Feature View of your website.
  • Go to Handler Mappings.
  • Find the path for .cshtml
  • Right Click and Click Edit Feature Permissions
  • Select Execute
  • Hit OK.

Now try refreshing your website.

protected by Sven Jan 5 '17 at 9:53

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.