1

I have a Classic ASP site I'm trying to set up with Anonymous Authentication. Below is my current setup:

  • App pool Identity: NetworkService
  • Anonymous Authentication User: IUSR

Assigning read and execute permissions to the IUSR account and the NETWORK SERVICE account on the site's directory allows for anonymous access. However, for some reason the NETWORK SERVICE permissions can be assigned to IIS_IUSRS and it achieves the same effect. This seems strange to me given that the app pool is running with the NetworkService identity selected, not the ApplicationPoolIdentity identity. And using net localgroup IIS_IUSRS reveals that NETWORK SERVICE is not a member of the IIS_IUSRS group on the machine.

So why would assigning permissions for IIS_IUSRS give access to the NETWORK SERVICE account?

I thought maybe there was some strange fallback logic where it tries to use the app pool's virtual account if it can't authenticate with NETWORK SERVICE, but running Process Monitor reveals the w3wp.exe process successfully authenticates using NT Authority\NETWORK SERVICE. Any ideas?

Here is some server info if it helps:

  • OS: Windows Server 2008 R2 Standard Service Pack 1
  • IIS: 7.5.7600.16385
  • App Pool: .NET Framework v2.0, Classic Managed Pipeline, NetworkService Identity
1

Any account that is running an IIS application pool is automatically added to the IIS_IUSRS group during runtime.

Or more correctly, the security token for the IIS_IUSRS group is added to the security tokens for the process running any application pool.

Looking at the static membership of the IIS_IUSRS group gives you the wrong idea of what is going on.

If you look at the security tab in Process Explorer, you should see BUILTIN\IIS_IUSRS as one of the groups of the w3wp.exe process.

  • So does that mean that assigning permissions to IIS_IUSRS will always work because it gets added to the security tokens regardless of what Identity I select for my app pool? What you're saying seems to make sense, though I was unable to see the IIS_IUSRS account in Process Explorer. Is there a way to view the security tokens at run-time? I would feel much better if I could just see that IIS_IUSRS was being used in action. – David Jul 8 '17 at 3:02
  • I don't have an 2008 R2 Server around, but it is my understanding that you should see ` IIS_IUSRS` on the security tab in Process Explorer. These are all the security tokens of that process. On 2016 with Classic Pipeline and network service, it does show up. – Peter Hahndorf Jul 8 '17 at 3:13
  • Sorry, I was using Process Monitor, not Process Explorer. After switching to Explorer I do in fact see the IIS_IUSRS group in the security groups. Thanks for explaining that, it's been driving me crazy all day with this permission inception. – David Jul 8 '17 at 3:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.