Windows – IIS_IUSRS Can Access a File, but Application Pool Identity User Cannot

application-poolsfile-permissionsiis-7.5permissionswindows

I am trying to understand IIS file permissions. A given file has "full control" permissions for IIS_IUSRS. But it seems all Application Pool Identity users cannot access the file. (I have noticed that some of my Application Pool Identity users were not members of IIS_IUSRS for some reason, so I simply added them manually.)

When a given Application Pool Identity is a member of IIS_IUSRS, how can it be that the Application Pool Identity user cannot access the file if IIS_IUSRS can access it? Please see my screenshots below. Thank you.

IIS_IUSRS has "Full Control."

IIS_IUSRS also has "Full Control" under "Effective Permissions," but a given Application Pool Identity user has no permissions under "Effective Permissions."

Best Answer

When using anonymous authentication by default IIS uses a specific user named IUSR to access files. This user is automatically a member of the Windows Users but not a member of IIS_IUSRS

If you removed permissions for Users from your files, the default site setup wont work anymore.

I usually don't use IUSR, to change this in the GUI, select the server or site node and open the Authentication icon, select Anonymous Authentication and the Edit in the Actions pane on the right:

Anonymous Authentication settings in IIS

change from a specific user to Application pool identity, now the file access is done via this account and it should be able to access your files.

You can do the same in PowerShell:

For the whole server:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.webServer/security/authentication/anonymousAuthentication" -name "userName" -value ""

For a specific site:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -location 'SiteName' -filter "system.webServer/security/authentication/anonymousAuthentication" -name "userName" -value ""

I wrote a bit about this in a blog post

Related Topic