1

An IIS website is run via an Application Pool which has its Identity advanced property set to ApplicationPoolIdentity. The website runs PHP scripts via a FastCGI handler. These scripts try to write to a file but the access is denied even the application pool user has enough permission. I have run ProcMon and it shows that the scripts are trying to open the files using IUSR instead of the application pool user.

  • Website example.com
    • Basic Settings - Application Pool = example.com
    • Basic Settings - Connect As = Application user (pass-through authentication)
  • Application Pool example.com
    • Advanced Settings - Process Model - Identity - ApplicationPoolIdentity
  • Script tries to write to a file
    • C:\ABC\test.txt
  • The directory C:\ABC has permission
    • IIS APPPOOL\example.com - Full control, Type Allow, Applies to This folder, subfolders and files

When I open the scripts url, I get PHP Warning: fopen(C:\ABC\test.txt): failed to open stream: Permission denied

When I run Sysinternal's ProcMon I see:

  • Event
    • Operation CreateFile
    • Result Access Denied
    • Path C:\ABC
    • Desired Access: Read Data/List Directory, Syncchronize
    • ShareMode: Read, Write, Delete
    • Impersonating: NT AUTHORITY\IUSR
  • Process
    • Path …\php-cgi.exe
    • User: IIS APPPOOL\example.com

How to fix it so the file is accessed using the example.com user?

  • Good question I normally just go screw it and set the upload directories "everyone" can read and write :D so would be interested if this gets answered :D – Martin Barker Apr 2 at 19:53
  • It runs as expected on another server but something is wrong on this one and I could not find what it is. – alik Apr 2 at 19:54
0

Finally found it. There is one more place that it needs to be set it up.

Site -> Authentication -> Anonymous Authentication -> Edit to "Application Pool Identity"

Source: PHP on IIS 7.5/W2K8 using IUSR Account not IIS_APPPOOL\DefaultAppPool

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.