I am confused about the differences between two accounts,

  • the Windows account which the appication pool will run on;
  • the related mapped Windows account when we use anonymous access to a web application to IIS.

What are the differences?

I am using Windows Server 2003 x64 + IIS 6.0.

thanks in advance, George


It is somewhat confusing isn't it. First, the anonymous access account has been around for ages, the idea of applicaiton pools is new in IIS 6. I think (although I have no evidence) that if IIS was being designed from scratch now, this isn't how it would be setup, it feels like it is just preserving compatability.

The application pool account requires certain permissions on the server. These are normally granted by adding the account to the IIS_WPG local group.
The anonymous access account doesn't require these permissions.
Assuming that your website is setup to allow anonymous access, then what account your page runs as will be determined by the impersonate setting of the web application. If impersonate is on then the request will be processed as the anonymous account. On the other hand, if impersonate is turned off, then the request will run as the application pool account, regardless of the authentication settings.
If you don't need impersonation then you will get slightly better throughput if you turn it off. I also think it is easier to follow if the page request runs as the application pool rather than having yet another account involved in the process.

I have written some small web applications for a corporate intranet. These tend to use windows authentication, so that ASP knows who is accessing the page, but don't impersonate, so the request runs as the application pool. This allows database access to run as a windows account which makes administration easier (IMO) and keeps our DBAs happy.
The one site that doesn't need to know who is running it, turns on anonymous access but leaves impersonation turned off.

EDIT: Further reading.
A quick search MSDN found this article which might help. I also found these two articles about how things have changed in IIS 7.
They seem to support my theory that the anonymous access account isn't really required now IIS supports application pools.

EDIT: About impersonation
ASP.NET will use settings from machine.config if there isn't a setting in the web.config. More information on how the various config files interact is here

  • Thanks pipTheGeek, 1. how to check whether a specific web application is using impersonation or not? In the related web.config, I do not find any impersonation settings. 2. Appreciate if you could recommend me some reading on this topics, and I want to learn more. – George2 Aug 16 '09 at 10:25
  • "These are normally granted by adding the account to the IIS_WPG local group." -- another confusion here. I have tried I can set any account to be the account which application pool will run on, seems it is not a must that the account to run application pool must belong to group IIS_WPG? – George2 Aug 16 '09 at 10:33
  • 1
    I have added an edit about asp.net config. As to the IIS_WPG, is the account that you are using a member of any other groups? – pipTheGeek Aug 16 '09 at 15:31
  • Hi pipTheGeek, the account (for both account running application pool and account mapped by anonymous access) I am using belongs to local Administrator group. It should not belong to IIS_WPG? Any comments? – George2 Aug 17 '09 at 13:20
  • Hi pipTheGeek, I made further study from the documents recommended by you. Especially these two ones, msdn.microsoft.com/en-us/library/ms526063.aspx and learn.iis.net/page.aspx/202/… my confusion is, from these two documents it is only mentioned when using anonymous authentication, the worker process identity will be used, and the account name of process user identity will be the anonymous account we set in IIS (e.g. IUSR_computer_name). None of them mentioned when impersonation is set off, application pool account will be used. – George2 Aug 17 '09 at 15:26

I'm a new user and don't have enough reputation points to comment so hopefully replying like this is fine. Great discussion. I thought I would insert a couple comments.

pipTheGeek, as you pointed out, this is much nicer in IIS7. You can set the site to always just use the app pool identity. Then you don't need to maintain 2 users anymore. This is great when you have 1 site per app pool, or all sites in the same app pool trust each other.

IIS_ WPG (without the space. This text sequence makes it italicized) is a requirement and isn't a consideration for impersonation. In IIS6, if you don't add a user to the IIS_ WPG group, it cannot be used as the identity of an app pool. The app pool will fail on the first attempt to use it. In IIS7, the user is injected into IIS_ WPG automatically so you don't need to worry about it anymore.

In terms of impersonation, it's not followed 100%, so you will always need at least read permissions for both the app pool identity and the anonymous or authenticated user. For example, if you use windows auth for your SQL Server connection string, it will always RevertToSelf and use the app pool identity rather than the anonymous (or authenticated) user's identity.

George, to confirm if you have impersonation set, use processmonitor from www.sysinternals.com. With that you can see what is being used on disk, and the properties of a line will show you if it impersonated or not. That's a free tool, safe on a production server and easy enough to learn.

Impersonation isn't enabled by default so if you don't see it in your web.config, it's probably not yet. However, if you're not the server admin, check the root web.config and machine.config too, in the framework\config folder, to confirm that it's not set there. Search for the word 'impersonate'.

Another side, whenever you see docs that talk about the ASPNET user, consider them old and for IIS5. What it really means in IIS6,7 is the app pool identity user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.