I'm trying to make my IIS server more secure and have locked down individual application folders so that only the relevant AppPool can access them. The AppPools have been given Read access but I have tried with read/write access too. I also moved wwwroot to another drive.

Unless I specify a domain admin account as the AppPool identity, I get the error below about the webconfig file not being readable.

An error occurred loading a configuration file: Failed to start monitoring changes to 'D:\wwwroot\web.config' because access is denied.

I can get around this particular error by doing this:

  • Right click on the application pool in IIS, Choose Advanced Properties. Under ProcessModel->Identity , choose Identity.
  • Choose Custom Account
  • Switch to using a Custom Domain account, that is an administrator on this machine, as well as the machine where the virtual directory is hosted.
  • Restart app pool

The problem is that now my website which looks at the currently logged in user, sees the domain account specified in the apppool instead of the logged in user.

It also seems a bit pointless setting NTFS permissions on my application folders if I am then going to override it with a domain admin account in the apppool anyway.

Any suggestions?

NTFS Permissions

  • What are the current NTFS permissions on your web.config file? You need to find out why the application pool identity does not have access to it. – Peter Hahndorf Apr 5 '18 at 11:36
  • Added an image showing the NTFS permissions – Syntax Error Apr 5 '18 at 11:39

I have fixed this by giving the servername\IIS_IUSRS group read access to the wwwroot directory and all subfolders. This probably nullifies my security improvements but it makes it work, so nevermind

  • Your changes to IIS related permissions and user rights, cannot go beyond any of the default settings, support.microsoft.com/en-us/help/981949/… Microsoft designs IIS that way, and to be secure. So you cannot use your own judgement as "security improvements". – Lex Li Apr 16 '18 at 12:31
  • I was trying to follow some of the things from here: adminspeak.wordpress.com/tag/iis-7-5-best-practices – Syntax Error Apr 16 '18 at 15:28
  • A non-Microsoft source can contain trivial mistakes (and tons of the issues come from such low quality posts). When in doubt, search from Microsoft KB articles or TechNet materials first. – Lex Li Apr 16 '18 at 15:30
  • I'll try. However sometimes the Microsoft documentation can be extremely confusing. – Syntax Error Apr 16 '18 at 15:32
  • A commercial user of Microsoft products should consider opening support cases via support.microsoft.com when confusion happens. But in your case, hire a security expert or a security firm would be a better option to protect your assets. – Lex Li Apr 16 '18 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.