Iis – Import IIS6 website configuration into IIS7

This sounds weird but you cannot use the IIS 7.0 user interface to create a Certificate Trust List (CTL). Follow these steps to create a CTL with IIS 7.0.

1. Use MakeCTL.exe to create the CTL. For more information on MakeCTL.exe, see the MakeCTL page on the MSDN site.

   The MakeCTL.exe tool is part of the .NET Framework SDK Version 1.1. Once you install the SDK, MakeCTL.exe appears in the following location:

\Program Files\Microsoft.NET\SDK\v1.1\Bin

2. After you create the CTL, you must run AdsUtil.vbs to assign the CTL identifier to the name used in MakeCTL.exe.

   adsutil.vbs set w3svc/1/SslCtlIdentifier

   where is the friendly name for the CTL used in MakeCTL.exe.

3. Run adsUtil.vbs to set the SslCtlStoreName.

adsutil.vbs set w3svc/1/SslCtlStoreName CA

4. After you have run AdsUtil.vbs, stop Web services by using the following command:

net stop HTTP /y

5. Restart the WS3SVC service by using the following command:

net start W3SVC

This sounds like a user access control problem.

With UAC turned on you are not a member of the Administrators group even if you log on as local administrator. You only "belong" to that group when you "run as administrator". So if you launch notepad "as administrator" you will be able to edit the files with no problem. So the answer is to either turn off UAC or grant your user account explicit Modify permissions to the file. Yes it is really annoying.

So that fixes the problem of you editing the config files, but it sounds like you want the app to also edit files. That sounds a bit dangerous, but probably acceptable if you are controlling who has access to the application.

The best approach is to put the web app in its own application pool not the default app pool. Then set the identity on the app pool to a specific user account, not the default network service account. Then grant that account the permissions it needs on the specific files and/or folders.