I am trying to set up FTP Publishing for a Site in IIS 8.5 (Windows Server 2012 R2) with a IISManagerAuth user. Unfortunately, I'm getting the dreaded Error 530-User cannot log in. It works perfectly with a Windows user, however. On further inspection, I got these messages:

530-User cannot log in.
Win32 error:   Access is denied. 
Error details: Filename: \\?\C:\Windows\system32\inetsrv\config\redirection.config
Error: Cannot read configuration file due to insufficient permissions

This seems to be the same problem detailed here: IIS 7.5, on Windows 7, IIS User can't log in, "Cannot read configuration file due to insufficient permissions"

The solution there is to grant Read Permission for the config folder and two files to Network Service:

ICACLS "%SystemDrive%\Windows\System32\inetsrv\config" /Grant "Network Service":R /T
ICACLS "%SystemDrive%\Windows\System32\inetsrv\config\administration.config" /Grant "Network Service":R
ICACLS "%SystemDrive%\Windows\System32\inetsrv\config\redirection.config" /Grant "Network Service":R

However, to the best of my knowledge this user is dead and gone in IIS 8 and upwards, replaced with ApplicationPoolIdentity. This is all pretty straightforward when setting permissions for the physical folders of a site: IIS APPPOOL\Poolname

As an experiment I have tried to grant read access on the folder and files mentioned above to this user, but that did not do the trick.

So I'm pretty much stumped, does anybody know which user is used to read these config files for IISManagerAuth? Which user needs permissions here? Or am I doing it completely wrong and the problem is completely different?

Thanks for your help!


I figured it out!

You need to add permissions on %SystemDrive%\Windows\System32\inetsrv\config

Add "Network Service" and give it Read permissions for the folder. I got an error about a subfolder when I did this... but it worked anyways.

  • Using Network Service ... is considered good practice security wise?? Wouldnt something like IIS AppPool\<apppoolname> not be the way to go, utilising ApplicationPoolIdentity and all?
    – Paul0515
    Aug 19 '16 at 17:12
  • As far as I know, there is no way to set what user would be requesting access to that config folder. I don't set my App Pools to use "Network Service" so I think thats probably not what happened... but the server of topic doesn't exist anymore so I can't check.
    – Ty H.
    Aug 22 '16 at 17:36
  • FTP server appears not to actually use the application pool identity. It uses the user account as registered with the FTP Service. Sofar hours of testing and fiddling ;-( But that does make it easier to solve, without the need to go back and use Network Service again. .. look at the answer I received here: serverfault.com/questions/797952/…
    – Paul0515
    Aug 22 '16 at 20:13

You are right, although it didn't work for me at first.

I had the additional problem that "Network Service" is actually not called "Network Service" in Non-English versions of Windows Server. I do not know why they did that, localizing the names of system users seems incredibly stupid to me. But I'm sure it seemed like a good idea at the time. So I did have the right idea in the beginning, I was just thrown by this technicality.

Should anyone have the same problem, either look for the localized user name or use the security identifier "*S-1-5-20".

This is how the above commands should read so they will work in any language version of Windows Server:

ICACLS "%SystemDrive%\Windows\System32\inetsrv\config" /Grant *S-1-5-20:R /T
ICACLS "%SystemDrive%\Windows\System32\inetsrv\config\administration.config" /Grant *S-1-5-20:R
ICACLS "%SystemDrive%\Windows\System32\inetsrv\config\redirection.config" /Grant *S-1-5-20:R

For more information, see Well-Known SID Structures

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.