I have a very simple site with only static files in IIS 7 on Windows Server 2008 SP2.

When I try to access any static file I get a 500 error. If I rename an html file to have an aspx extension it works fine.

The site also works fine when using the built in identity for the application pool. The problem occurs when I switch to using a custom account for the application pool. I have tried using both local and domain accounts to run the application pool under.

I have given full control to these accounts on the website directory and files.

Turning on tracing reveals this error message:
ModuleName: IIS Web Core
Notification: 2
HttpStatus: 500
HttpReason: Internal Server Error
HttpSubStatus: 0
ErrorCode: 2147943746
ErrorCode: Either a required impersonation level was not provided, or the provided impersonation level is invalid. (0x80070542)

I have not had any luck with googling the error code.


Prolem Solved: The IIS_IUSRS group was missing from the "impersonate a client after authentication" in the local security policy.

| improve this answer | |
  • Worked for me thanks! But in addition here is how to do it step by step for dummies like me: Start > Local > Security Policy > Local Policies > User rights Assignment > Impersonate a client after authentication > Add User or Group... > Select IIS_IUSRS – Wowe Oct 8 '18 at 6:39

you can try to change application pool for this virtual application and give for this new pool personal permissions

to give permissions for specific pool just give permissions for user "IIS APPPOOL\YOUR_POOL_NAME"

| improve this answer | |

In addition to Brownie's answer (it is correct, you have to give this right to the app pool account); if IIS sends you this error when you call it using a WCF client (+ Windows-authentication is enabled in IIS), it may be because the flags of the NTLM token given to IIS does not allow it to impersonate the caller.

Modify the config of your client from this (the default):

<behavior name="NewBehavior">
    <windows allowedImpersonationLevel="Identification" />

To this:

<behavior name="NewBehavior">
    <windows allowedImpersonationLevel="Impersonation" />

Check this article for details: Impersonation and Delegation in WCF

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.