Windows – Which user does PHP/IIS6 use to read/write files

The IUSR and the Network Service account are both used by IIS. Here are my recommendations...

1. For a public website available to everyone:

The IUSR and Network Service need to have Read access to all the application files (.aspx pages etc.) and dlls for the website. The IUSR would need to have Write access to any folder where the website is writing files (this could be dangerous on a public site). The database would be accessed by a SQL or Network account specified in the web.config in the database connection section.

2. For a website with Forms Authentication (login via a login page using username and password):

Same as above. The Write access to any folder is now better protected because the person using the website has been authenticated by your application.

3. For a website using Integrated Authentication:

The user credentials of the authenticated user need to have Read access to all the application files (.aspx pages etc.) and dlls for the website. The user credentials of the authenticated user would need to have Write access to any folder where the website is writing files. The database would be accessed by a SQL or Network account specified in the web.config in the database connection section or by the the user credentials of the authenticated user.

Update The Network Service account (or whatever account you are using for your application pool) and the IUSR work together. It is not always 100% clear to me which account is controlling access to which resources but I do know from experience that you need to have both. The IUSR is used for accessing .aspx pages, image files, static content, etc. The Network Service account accesses the IIS metabase, your application dlls, the .Net framework files, etc. Hope this helps.

IIS will not serve a file with an extension it does not have a MIME type mapping for - see http://support.microsoft.com/kb/326965 for details including how to edit the mappings.

Have you changed/installed anything that might have removed the MIME mapping for .exe files from IIS at all?

Also, some proxies and security add-ins may block .exe files - have you added or reconfigured anything like that recently?