I have a Classic ASP site I'm trying to set up with Anonymous Authentication. Below is my current setup:
- App pool Identity: NetworkService
- Anonymous Authentication User: IUSR
Assigning read and execute permissions to the
IUSR account and the
NETWORK SERVICE account on the site's directory allows for anonymous access. However, for some reason the
NETWORK SERVICE permissions can be assigned to
IIS_IUSRS and it achieves the same effect. This seems strange to me given that the app pool is running with the NetworkService identity selected, not the ApplicationPoolIdentity identity. And using
net localgroup IIS_IUSRS reveals that
NETWORK SERVICE is not a member of the
IIS_IUSRS group on the machine.
So why would assigning permissions for
IIS_IUSRS give access to the
NETWORK SERVICE account?
I thought maybe there was some strange fallback logic where it tries to use the app pool's virtual account if it can't authenticate with
NETWORK SERVICE, but running Process Monitor reveals the w3wp.exe process successfully authenticates using
NT Authority\NETWORK SERVICE. Any ideas?
Here is some server info if it helps:
- OS: Windows Server 2008 R2 Standard Service Pack 1
- IIS: 7.5.7600.16385
- App Pool: .NET Framework v2.0, Classic Managed Pipeline, NetworkService Identity