I set up a global error handler in my ASP.net application, using Log4Net and a RollingLogFileAppender which has worked quite nicely up until.

I'm in the middle of an upgrade to IIS 7 on Windows 2008 server, and I can't get the logging working. I think errors are being raised, but ASP.net doesn't have the permissions needed to write to the specified folder. Now, I would normally just grant full rights to the ASPNET user and be done with it, except that user account does exist anymore. Also, I can't find the "Everyone" user group either. I don't want to go fooling around creating new user accounts, setting up impersonation etc etc. Is there an easy solution?

3 Answers 3


In IIS6 and IIS7, the equivalent for ASP.NET to the ASPNET user is the application pool identity user. By default that's NETWORK SERVICE in IIS7, and the App Pool identity in IIS 7.5+. You can grant that user permissions to disk and it will work.

The 'better' way is to create custom users per app pool and assigning them permission to disk so that the sites are isolated from each other, and so that other applications on the server that use Network Service can't access the content of your sites. However that's a judgment call that you need to make in your situation.

The other user that comes into play is the anonymous or authenticated user of your site. That's defined in the authentication -> anonymous section of your site. In IIS7 I recommend setting that to use the app pool identity, as long as you only have 1 site per pool, or as long as each site in the app pool highly trust each other. Then you only need to maintain 1 user on disk.

  • In IIS7 the properties of each app pool say whether it's using 'app pool identity' or a real user like Network Service. If it's using app pool identity then it runs using a special identity "IIS AppPool[app pool name]", e.g. "IIS AppPool\MyAppPool". You can grant file & other permissions to that user using normal file properties window. When an app pool is running with application pool identity when it connects to resources on a different machine it presents itself using the identity "DOMAIN\SERVER$" so grant access to that identity (e.g. network file permissions or SQL Server windows auth).
    – Rory
    Feb 14, 2013 at 16:12
  • Where "DOMAIN\SERVER$" is replaced with actual domain name and server name but keeping the trailing $, e.g. "MYDOM\SRV123$"
    – Rory
    Feb 14, 2013 at 16:13
  • Thanks for the update Rory. I updated the post to mention IIS 7.5 and later, which didn't exist when this was first written. The app pool identity is available in IIS 7 too but only from the command line. Feb 26, 2013 at 21:56
  • 2
    Cool. A useful link for folk about Application Pool Identities here: iis.net/learn/manage/configuring-security/…
    – Rory
    Feb 26, 2013 at 22:11
  • Thanks so much, @Rory. Mentioned link saved my day :)
    – QMaster
    Mar 12, 2019 at 14:06

In my case giving permissions to NETWORK SERVICE was not enough. I needed to add permissions for IUSR user as well as IIS_IUSRS too.


I was able to solved one of "access denied" error (on Windows web server 2008 + IIS 7 setup) by following below instruction:

  • Your Folder - right click - Security tab
  • Click on "Advanced" button
  • In "Permissions" tab click "Edit..." button. This will give you another dialog which has functionality to add User/Group object.
  • When click "Add..." it wll give known interface (which is available earlier version of windows) to add user/group object.
  • Find NETWORK SERVICE and set appropriate permission and u r done.

I am not sure whether it is correct way to day this but it worked for me.

I hope this will be of any user to you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .