4

I set up a global error handler in my ASP.net application, using Log4Net and a RollingLogFileAppender which has worked quite nicely up until.

I'm in the middle of an upgrade to IIS 7 on Windows 2008 server, and I can't get the logging working. I think errors are being raised, but ASP.net doesn't have the permissions needed to write to the specified folder. Now, I would normally just grant full rights to the ASPNET user and be done with it, except that user account does exist anymore. Also, I can't find the "Everyone" user group either. I don't want to go fooling around creating new user accounts, setting up impersonation etc etc. Is there an easy solution?

Patrick J Collins
  • 165
  • 2
  • 3
  • 7

3 Answers3

3

In my case giving permissions to NETWORK SERVICE was not enough. I needed to add permissions for IUSR user as well as IIS_IUSRS too.

German Latorre
  • 131
  • 6
3

In IIS6 and IIS7, the equivalent for ASP.NET to the ASPNET user is the application pool identity user. By default that's NETWORK SERVICE in IIS7, and the App Pool identity in IIS 7.5+. You can grant that user permissions to disk and it will work.

The 'better' way is to create custom users per app pool and assigning them permission to disk so that the sites are isolated from each other, and so that other applications on the server that use Network Service can't access the content of your sites. However that's a judgment call that you need to make in your situation.

The other user that comes into play is the anonymous or authenticated user of your site. That's defined in the authentication -> anonymous section of your site. In IIS7 I recommend setting that to use the app pool identity, as long as you only have 1 site per pool, or as long as each site in the app pool highly trust each other. Then you only need to maintain 1 user on disk.

Scott Forsyth
  • 16,449
  • 3
  • 37
  • 56
  • In IIS7 the properties of each app pool say whether it's using 'app pool identity' or a real user like Network Service. If it's using app pool identity then it runs using a special identity "IIS AppPool\[app pool name]", e.g. "IIS AppPool\MyAppPool". You can grant file & other permissions to that user using normal file properties window. When an app pool is running with application pool identity when it connects to resources on a different machine it presents itself using the identity "DOMAIN\SERVER$" so grant access to that identity (e.g. network file permissions or SQL Server windows auth). – Rory Feb 14 '13 at 16:12
  • Where "DOMAIN\SERVER$" is replaced with actual domain name and server name but keeping the trailing $, e.g. "MYDOM\SRV123$" – Rory Feb 14 '13 at 16:13
  • Thanks for the update Rory. I updated the post to mention IIS 7.5 and later, which didn't exist when this was first written. The app pool identity is available in IIS 7 too but only from the command line. – Scott Forsyth Feb 26 '13 at 21:56
  • 2
    Cool. A useful link for folk about Application Pool Identities here: http://www.iis.net/learn/manage/configuring-security/application-pool-identities – Rory Feb 26 '13 at 22:11
  • Thanks so much, @Rory. Mentioned link saved my day :) – QMaster Mar 12 '19 at 14:06
0

I was able to solved one of "access denied" error (on Windows web server 2008 + IIS 7 setup) by following below instruction:

  • Your Folder - right click - Security tab
  • Click on "Advanced" button
  • In "Permissions" tab click "Edit..." button. This will give you another dialog which has functionality to add User/Group object.
  • When click "Add..." it wll give known interface (which is available earlier version of windows) to add user/group object.
  • Find NETWORK SERVICE and set appropriate permission and u r done.

I am not sure whether it is correct way to day this but it worked for me.

I hope this will be of any user to you.