0

It's a newly setup server in a new domain.

I added a website to IIS and created an application pool for it. As soon as I try to set a different User (Identity) to run the Application Pool I receive an error.

There was an error while performing this operation. 
Details :
Value does not fall within expected range.

The User is domain User and part of Administrator group, I also added him to IIS_IUSRS group - without success.

I tried a to use my user account and it didn't work either. Only localservice or localsystem are working, no custom users. Since the Event log is empty I run out of ideas. I deleted the website deleted apppool, recreated already many times, no success.

Windows server 2012, IIS 8

1

2 Answers 2

2

I have also run into this problem in Windows Server 2012. Trying to set the App Pool identity from the command line you receive a similar error:

C:> appcmd set config /section:applicationPools 
     /[name='test-pool'].processModel.identityType:SpecificUser 
     /[name='test-pool'].processModel.userName:MyAccountName 
     /[name='test-pool'].processModel.password:P@ssw0rd

ERROR ( hresult:80070057, message:Failed to commit configuration changes.
  The parameter is incorrect.
 )

If you remove the last parameter the command will succeed changing identity type and setting the username. I did never figure out why I could not set the password so I retorted to editing my applicationHost.config file directly. Unfortunately with the the password in clear text.

<configuration>
   ...
    <system.applicationHost>
        <applicationPools>
            ...
            <add name="test-pool" managedRuntimeVersion="v4.0">
                <processModel identityType="SpecificUser" 
                  userName="MyAccountName" password="P@ssw0rd" />
            </add>
            ...
        </applicationPools>
        ...
    </system.applicationHost>
    ...
</configuration>

In addition to configuring the app pool to use a specific account I made the following:

1) Included the user in the IIS_IUSRS group that indirectly gives it Logon as Batch Job rights.

2) Run the following command to grant rights to the user

aspnet_regiis -ga <your_app_pool_user>

See more: How To: Create a Service Account for an ASP.NET 2.0 Application (MSDN)

3) Restarted WAS and IIS to make sure the changes to the accounts group membership takes hold.

C:> net stop was /y
C:> net start w3svc
3

I had this issue with a new IIS 10 deployment. Our network team copied over the applicationhost.config file from the older servers and this caused it. In IIS 10 there are two new settings that encrypt the password for the app pool identity. Since the IIS 7 config file didn't have those encryption settings then IIS threw this error when assigning a new user. I simply copied over the settings from a brand new server build and it started working fine. Add these two settings to the existing ones already there:

<configProtectedData>
<providers>

    <add name="IISCngProvider" type="Microsoft.ApplicationHost.CngProtectedConfigurationProvider" description="Uses Win32 Crypto CNG to encrypt and decrypt" keyContainerName="iisCngConfigurationKey" useMachineContainer="true" />
    <add name="IISWASOnlyCngProvider" type="Microsoft.ApplicationHost.CngProtectedConfigurationProvider" description="(WAS Only) Uses Win32 Crypto CNG to encrypt and decrypt" keyContainerName="iisCngWasKey" useMachineContainer="true" />

</providers>
</configProtectedData>
1
  • This fixed the issue for me. c:\windows\system32\inetsrv\config is where the config xmls files are stored. When restoring config from an older version of IIS, I also had to upgrade the version numbers in the moduleProviders section of the administration.config file. Be sure to backup your original .xml files so you can compare the default applicationHost.xml and administration.xml to the one you restore or copy over. Also, you'll need to copy your RSA keys from the older server using aspnet_regiis. Thanks for sharing, user441058! May 23, 2023 at 8:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .