2

Place of crime is WinSrv2008 with IIS7.
My IIS apppool user is trying to create a folder but fails. How do I find out which User it is?

Let's say I don't know much about IIS7 and Aspnet but need to trace whatever is happening through tools.

So I fire up Sysinternals/ProcessMonitor to find out what is happening.
I find Access denied on a folder just as I suspected. But which user? I add the User column to the output or ProcessMonitor and it says IIS Apppool\Defaultapppool in capitals. Well... that isn't a user is it? If I go to IIS and its Apppools and Advanced settings and Process model and Identity I can see clues about which user it is but that is only because I know IIS. What if it had been Apache or LightHttpd or whatever? How do I see the user to give the appropriate rights to?

4 Answers 4

5

Actually, the IIS AppPool\DefaultAppPool IS a user and you can add 'Modify' permissions to the parent folder to allow it to create subfolders etc - have a read of http://www.iis.net/learn/manage/configuring-security/application-pool-identities for some more information.

4

By default IIS 7+ uses the IUSR user account and IIS_IUSRS group account for permissions. You need to either A) Use a named account or B) give permission to the IUSR user or IIS_IUSRS group. Microsoft's IIS Site has a great intro to built-in accounts.

Option A is probably the best approach. You would do this by going into IIS Manager, Selecting Application Pools then Right clicking on the Application pool you want to modify and select "Advanced Settings"

Once in the Advanced settings there is an option under the "Process Model" area called "Identity". You then click on the box next to this entry and click on the ellipses that show up. The menu that appears will allow you to set a custom account for the Application Pool

2
  • Yes, this is also what I did to solve the problem. But what if I didn't know much about IIS and Aspnet? Say it was Apache or LightHttpd. What tools can I use? Sysinternals/Processmonitor i suppose but it doesn't show the user. Or where does it?
    – LosManos
    Dec 13, 2012 at 8:34
  • @LosManos For Apache (and probably LightHttpd) the user for those would be the user account that the service is configured to run under in the Services control panel.
    – Zypher
    Dec 13, 2012 at 18:02
0

I'd suggest turning on "object access" auditing and check the audit log.

Can be enabled through group policy

http://www.techotopia.com/index.php/Auditing_Windows_Server_2008_File_and_Folder_Access

or manually

http://windows.microsoft.com/en-IN/windows7/Monitor-attempts-to-access-and-change-settings-on-your-computer

0
+50

You are already using the right tool (ProcessMonitor), its just that the account name looks a bit funny.

'IIS Apppool\DefaultAppPool' is indeed a valid Windows user account, even though it is special. It doesn't have a password and you can not use it to log on. It is not even listed in any of the built-in tools to list user accounts.

However you can assign permissions to it, you just have to type the full name in the GUI or in 'icacls.exe'. Because you don't see it listed anywhere I usually add these user types to a group and then assign permissions to the group.

net localgroup groupName "IIS AppPool\Defaultapppool" /ADD

Each IIS application pool that has it's identity property set to 'ApplicationPoolIdentity' (the default in IIS8) has one of this special accounts.

The main reason to have these accounts is to have the ability to set permissions on an AppPool basis without having to manage many user accounts and rather than using the same user account for all appPools.

Similar to "IIS AppPool*" are the "NT SERVICE*" which are user accounts to run Windows services under without having to manage them, but you are still able to assign permissions to these users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .