I have an asp.net website containing a WCF service that I am developing on a Windows 7 machine hosted with IIS 7. I am needing to connect to an instance of Reporting Services 2005 with the service, and have been getting 401 errors when trying to execute reports. So, I assume that I need to be running the IIS Application pool under a domain account. The problem is that when I try to change the identity to a domain account, I get the error message "The specified password is invalid. Type a new password." I've rechecked the password multiple times to make sure it is correct. The account I'm using has admin rights on the machine.

I saw elsewhere to try running this command: aspnet_regiis.exe -GA domain\username which I did but it didn't help. What else do I need to do?


If you are getting an invalid password error then either the password or user account could not be validated.

Make sure the username is in the format of DOMAIN\username or username@domain.ext.

Also, make sure the account isn't locked, disabled, etc.

Worst case, change the password on the account. If it says the password isn't right, most likely it isn't.

  • No luck. I tried 2 different domain accounts several times to verify the password. Which built in account would I use so that I could identify it with my machine name, i.e., domain\computername$ ? If I could use that as the app pool identity, I could set permissions on the reporting server to accept it. Thanks. – Luke Van Diest Aug 27 '12 at 17:32
  • Thats not how the App Pool works in IIS7+. It actually runs under a machine account for each individual application pool. Check out this IIS help page: learn.iis.net/page.aspx/624/application-pool-identities – Brent Pabst Aug 27 '12 at 18:02

Are you using "&" in the password for the application pool?

I have seen an issue where all .config files got corrupted because the password contained “&” as one of the chars. Had to change the password and update all .config files with a new password and reconfigure all services to use this new password.


Note that if you use the notation with DOMAIN\AccountName, you must use the account name as written in the "pre-Windows 2000" box from the AD-configuration. This is limited to 20 characters and regardless of length it may be different from the AccountName@domain.tld format.

If you try to use the account name that goes with the @domain.tld format, but write it using DOMAIN\AccountName format, IIS will also unhelpfully blame the problem on invalid password when really it's not actually a valid account name.

Not the answer you're looking for? Browse other questions tagged or ask your own question.