0

I'm sure there is a logical explanation to this anomaly, but I'm interested in what it is.

Here is the setup:

  1. Create a TEST folder on a local drive (C:\TEST)
  2. Configure a new IIS Site and Application Pool (Call it TEST) - Point it to C:\Test and set it to run as ApplicationPoolIdentity.
  3. Create a simple index.html file in C:\TEST
  4. Remove all permissions from C:\TEST except for the typical Administrators, SYSTEM, and TrustedInstaller. No regular user permissions exist.

Scenario 1:

  • Try to view the new website.
  • Observe that the user receives an error message.

Scenario 2:

  • Add Read permissions to C:\TEST for IIS AppPool\TEST
  • Refresh browser windows and observe Index.html is properly displayed.

Scenario 3:

  • Change TEST application pool identity to run as domain user (domain\test). Restart the application pool.
  • Refresh the browser and observe the user can still access the Index.html page.
  • Confirm in Task Manager that the site is, indeed, running as Domain\Test.

Scenario 4:

  • Remove IIS AppPool\TEST permissions on C:\TEST.
  • Refresh the browser and observe the user receives an error message.

Scenario 5:

  • Add Read permissions for Domain\Test on C:\TEST.
  • Refresh the browser and observe the user can see Index.html again.

Question:

Even though the application pool has been changed to run under a domain user account, how come the site can still access the website files when permissions have been only given to the built in ApplicationPoolIdentity (IIS AppPool\TEST) as observed in Scenario 3?

I would expect Scenario 3 to fail, and only Scenario 5 to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.