I'm sure there is a logical explanation to this anomaly, but I'm interested in what it is.
Here is the setup:
- Create a TEST folder on a local drive (
- Configure a new IIS Site and Application Pool (Call it TEST) - Point it to
C:\Testand set it to run as
- Create a simple
- Remove all permissions from C:\TEST except for the typical
TrustedInstaller. No regular user permissions exist.
- Try to view the new website.
- Observe that the user receives an error message.
- Refresh browser windows and observe Index.html is properly displayed.
TESTapplication pool identity to run as domain user (
domain\test). Restart the application pool.
- Refresh the browser and observe the user can still access the Index.html page.
- Confirm in Task Manager that the site is, indeed, running as
IIS AppPool\TESTpermissions on
- Refresh the browser and observe the user receives an error message.
- Refresh the browser and observe the user can see Index.html again.
Even though the application pool has been changed to run under a domain user account, how come the site can still access the website files when permissions have been only given to the built in ApplicationPoolIdentity (
IIS AppPool\TEST) as observed in Scenario 3?
I would expect Scenario 3 to fail, and only Scenario 5 to work.