I have an ASP.NET MVC 5 application running on IIS 8.0. Application pool is running under domain user, f.i. IISPoolUser. Anonymous authentication uses this identity as well.

I gave full control permissions on root pool folder (C:\inetpub\wwwroot) and everything worked fine.

Now, I want to enable Windows authentication. When someone (f.i., WebUser) tries to access this application, he gets login prompt dialog and then gets 401 Unathorized - "Access is denied due to invalid credentials" error. A browser sends proper authentication headers - the problem is related to directory access.

If I give permission to user WebUser to folder C:\inetpub\wwwroot, then it works fine. ASP.NET impersonation is disabled.

Graphical representation

Why does IIS uses WebUser identity to access directory? I want IIS to access this folder as application pool identity - IISPoolUser. How to make it do this? I don't want to add Everyone to directory permissions, because it sounds wrong, in general - I want only allow to modify this directory through my IIS application.

  • The problem is now fixed by giving Read permissions to group Everyone. Still, since it is actually not a solution and explanation, the question is open. – Yeldar Kurmangaliyev Mar 1 '16 at 11:28

You should give read permissions to the group YOURDOMAIN\Domain Users

You shouldn't give read permission to everyone for obvious security reasons.

IIS uses impersonation to access the folder and if the domain users don't have read permission to that folder, they keep getting the password prompt and they get the 401 error on the third try.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.