3

Sorry if this has been answered. But I went through many posts, nothing worked for me.

First of all, I am new in IIS management. We have an app in IIS 8 and application pool is configured under a domain account(application Pools-->Advaced Setting-->Identity). Shared folder in a different server within our network, in same domain.

When we login to IIS hosted machine using the same domain account, this account can browse the shared folder. However, the web application is not able to find this path. Also, if we setup a shared folder in the same machine as the IIS server, our web application is able to find that location. So web application is able to find the location as long as they both are at same server.

Also, domain account was given access to shared folder.

Also, I am not sure how to get more logs. I see logs are setup at C:\inetpub\logs\LogFiles\W3SVC1, but it does not have any valuable information on this issue.

Thank you.

4

If the site uses Anonymous Authentication, go to the Web Site > Authenication > Anonymous Authentication. Click on Edit and change the identity from IUSR to Pass-Through or App Pool User. This will switch IIS to use the application pool account to access resources when anonymous authentication is used. Otherwise it will be using the local IUSR account which may identify itself as the computer account when accessing remote content instead of the application pool account

If you're using Windows Authentication + Impersonation, then you're having a double-hop problem. I won't go onto details yet until the authentication mechanism is confirmed.

| improve this answer | |
  • You are right. We are using Windows Authentication with impersonation. We also enabled delegation on all test servers, the second option "Trust this computer for delegation to any service (Kerberos only)" is checked. Is there any other setup we need to do? Is there any other change we need to make? – sbUser Sep 14 '16 at 16:16
  • So, if you're doing Kerb only, then it's important that all hops are Keberos hops. Have you confirmed the first hop is Kerberos? If you capture a Fiddler trace when the first Windows Authentication happens, do you see the browser sending Authorization: Negotiate YII....? – milope Sep 15 '16 at 12:44
  • perfect, it solve my prob! – elle0087 Mar 15 '19 at 13:55
1

If you are using a PHP script and the window authentication is enable on your site, you need check if the php.ini file for impersonation flag is set. If so, it needs to be turned off. You don't want IIS to impersonate a IUSR user. It needs to pass the user credential to the share folder which is set by AD. Afterward stop and start your site. I hope this will help.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.