1

I can't seem to wrap my head around this one. The IIS docs (and countless forum posts) are quite clear about the rights needed to run an IIS app pool, which include batch logon rights (Log on as a batch job). I've confirmed this when running an app pool as a domain account, where the worker process won't start if the domain account doesn't have this right.

However, when I run an app pool using the built-in "app pool identity" (IIS AppPool\[app pool name]), the pool runs fine even if this identity does not have the batch logon rights (it spins up, services requests, etc. without issue). This particular right is locked down via domain GPO and neither this identity, nor the IIS_IUSRS local group (which, as I understand it, the built-in app pool accounts are granted membership in dynamically at runtime) has this right.

Now, IIS did automatically grant certain other rights to the app pool identities (and does so anytime a new app pool is created), such as "Generate security audits", "Log on as a service", etc. But these obviously don't substitute for the fact that it is missing "Log on as a batch job". Running the "accesschk" tool from the SysinternalsSuite confirms that these accounts do not have this right.

This link describes the default permission in IIS v7+, and notes that app pool identities are granted certain rights, and that the IIS_IUSRS local group is granted "Log on as a batch job" by default (which explains why the app pool identities work out of the box):

https://support.microsoft.com/en-us/help/981949/description-of-default-permissions-and-user-rights-for-iis-7-0-and-lat

But, I still can't understand how they could work properly in an environment where the batch logon right is locked down via domain GPO and neither the IIS_IUSRS group nor the app pool identities have been included in the policy.

This is observed on Server 2012R2 (IIS v8.5), and interestingly, when I dug around a bit I also see the same behavior with app pools running as NetworkService in Server 2016 (IIS v10) (same environment - batch logon right locked down via domain GPO, and NetworkService not included in that policy).

So it would seem that for some reason, local accounts are not subject to needing the batch logon right to run an app pool. Of course, if we try to run the pool under a domain account without these rights it will absolutely fail. I thought it at first it was only the app pool "virtual accounts", but that wouldn't explain the same behavior with NetworkService - so maybe only built-in local accounts? I don't know.

Is anyone able to shed any light on this?

  • Application pool identities are virtual accounts, docs.microsoft.com/en-us/iis/manage/configuring-security/… So how they work internally is far from well documented by Microsoft and I don't believe you can use the above observation to answer this question. Your only hope is to consult Microsoft, usually by opening a support case via support.microsoft.com – Lex Li Jan 16 at 17:43
  • Thanks for the response - I understand that they are virtual accounts - I just found it interesting that they didn't seem to require the same permission that a domain account would in order to run the app pool and thought someone might have some insight as to why. You're right though - its very possible MS are the only ones who would really know. – dwillis77 Jan 16 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.