My any applications run in pool with custom user account "IIS Universal".
I have 4 pools working under this account.
This account have full control access to the file and all parent folders:
But when applications try to write there are not access.
They write with log4net, whose log give me this:
Related
How can you give ApplicationPoolIdentity permissions to write to the Application Event Log?
I've read about adding a user to the permissions for HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog but I can't find the user ApplicationPoolIdentity
And how can I have this as part of the deployment for a web site? ... specifically to Azure Web App Service
You cannot modify the registry of an instance in App Service as the sandbox in Azure App Service doesn't allow you to modify registry. More details here
As long as you are not creating a new Event Source, your application logging will continue to work and the events will be written to EventLog.xml (which is a lightweight event log file). You can read more details about this in https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox#access-to-event-log.
You can access the eventlog.xml file directly from KUDU under D:\HOME\LOGFILES folder, or from support portal or by using a website extension which I wrote some time back. More details on this in https://blogs.msdn.microsoft.com/puneetgupta/2014/09/24/azure-website-siteextension-to-view-eventlogs/
I have a web application that is running on IIS 7.5 and is having some permission issues. The site will read/serve files, but will not write to any file location under any circumstances. Ideally, I'd be writing to a non-local share, but I'm currently just trying to get the application to write to a local share/drive. I've tried setting the identity to a domain service account set up specifically for this application, the built in Network Service account, and the ApplicationPoolIdentity with no luck. It may be worth mentioning that this server is a virtualized instance running on shared hardware with other servers.
In order to try and grasp the issue, I have granted full control to:
(MACHINE NAME)
(MACHINE NAME)\Users
(MACHINE NAME)\IUSR
(MACHINE NAME)\IIS_IUSRS
(DOMAIN NAME)\(MACHINE NAME)
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
(APPLICATION POOL IDENTITY)
(DOMAIN NAME)\(SERVICE ACCOUNT NAME)
I have manually verified that all these accounts/groups have full control on the security tab of the file/folder.
The app pool is running under the .NET Framework v4.0 on the Integrated Managed Pipeline. I've tried it with Load User Profile set to both true and false with no luck. The site itself is set to application pass-through authentication.
The error thrown in the browser is:
Access to the path 'D:\Dataload\LOG.txt' is denied.
[UnauthorizedAccessException: Access to the path 'D:\Dataload\LOG.txt' is denied.]
I've tried writing to that file with it already created as well as not created. I've also tried calling the file by its server path instead of the drive name.
Viewing the event in Microsoft's Process Monitor:
Operation: CreateFile
Result: ACCESS DENIED
Desired Access: Generic Write, Read Attributes
Disposition: OpenIF
Options:Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Open No Recall
Attributes:n/a
ShareMode: Read
User:NT AUTHORITY\NETWORK SERVICE (this will correctly change depending on the identity I set)
Is there something I am missing with groups or accounts, or possibly an IIS setting I could be overlooking that prevents write access?
I figured out the answer to this a while back and forgot about my post here. In this particular instance, the problem was with the Internet Explorer Enhanced Security Configuration settings on the server. In order to see your settings in Windows Server 2008 R2, go to the Server Manager and have your view on the main page. Once there, go down to the Security Settings section. Here you will see an item called IE Enhanced Security Configuration (ESC), and next to it it's current settings for both administrators and users. In my case, the default settings on this fresh server were set to On for both administrators and users. Setting these to Off allowed the network service account to write to all locations it had been granted proper permissions to, thus solving the problem.
I've just moved away from IIS6 on Win2003 to IIS8 on Win2012 for hosting ASP.NET applications.
Within one particular folder in my application I need to Create & Delete files. After copying the files to the new server, I kept seeing the following errors when I tried to delete files:
Access to the path 'D:\WebSites\myapp.co.uk\companydata\filename.pdf' is denied.
When I check IIS I see that the application is running under the DefaultAppPool account, however, I never set up Windows permissions on this folder to include IIS AppPool\DefaultAppPool
Instead, to stop screaming customers I granted the following permissions on the folder:
IUSR
Read & Execute
List Folder Contents
Read
Write
IIS_IUSRS
Modify
Read & Execute
List Folder Contents
Read
Write
This seems to have worked, but I am concerned that too many privileges have been set. I've read conflicting information online about whether IUSR is actually needed at all here. Can anyone clarify which users/permissions would suffice to Create and Delete documents on this folder please? Also, is IUSR part of the IIS_IUSRS group?
Update & Solution
Please see my answer below. I've had to do this sadly as some recent suggestions were not well thought out, or even safe (IMO).
I hate to post my own answer, but some answers recently have ignored the solution I posted in my own question, suggesting approaches that are nothing short of foolhardy.
In short - you do not need to edit any Windows user account privileges at all. Doing so only introduces risk. The process is entirely managed in IIS using inherited privileges.
Applying Modify/Write Permissions to the Correct User Account
Right-click the domain when it appears under the Sites list, and choose Edit Permissions
Under the Security tab, you will see MACHINE_NAME\IIS_IUSRS is listed. This means that IIS automatically has read-only permission on the directory (e.g. to run ASP.Net in the site). You do not need to edit this entry.
Click the Edit button, then Add...
In the text box, type IIS AppPool\MyApplicationPoolName, substituting MyApplicationPoolName with your domain name or whatever application pool is accessing your site, e.g. IIS AppPool\mydomain.com
Press the Check Names button. The text you typed will transform (notice the underline):
Press OK to add the user
With the new user (your domain) selected, now you can safely provide any Modify or Write permissions
IUSR is part of the IIS_IUSER group, so I guess you can remove the permissions for IUSR without worrying. Further reading
However, a problem arose over time as more and more Windows system services started to run as NETWORKSERVICE. This is because services running as NETWORKSERVICE can tamper with other services that run under the same identity. Because IIS worker processes run third-party code by default (Classic ASP, ASP.NET, PHP code), it was time to isolate IIS worker processes from other Windows system services and run IIS worker processes under unique identities.
The Windows operating system provides a feature called "Virtual Accounts" that allows IIS to create unique identities for each of its Application Pools. DefaultAppPool is the default pool that is assigned to all Application Pools you create.
To make it more secure you can change the IIS DefaultAppPool Identity to ApplicationPoolIdentity.
Regarding permissions, Create and Delete summarize all the rights that can be given. So whatever you have assigned to the IIS_USERS group is all that they will require.
When I added permissions for IIS_IUSRS to the site folder, resources like JavaScript and CSS were still inaccessible (error 401, forbidden). However, when I added IUSR, it started working. So for sure you cannot remove the permissions for IUSR.
#EvilDr
You can create an IUSR_[identifier] account within your AD environment and let the particular application pool run under that IUSR_[identifier] account:
"Application pool" > "Advanced Settings" > "Identity" > "Custom account"
Set your website to "Applicaton user (pass-through authentication)" and not "Specific user", in the Advanced Settings.
Now give that IUSR_[identifier] the appropriate NTFS permissions on files and folders, for example: modify on companydata.
IIS_IUSRS group has prominence only if you are using ApplicationPool Identity. Even though you have this group looks empty at run time IIS adds to this group to run a worker process according to microsoft literature.
I would use specific user (and NOT Application user). Then I will enable impersonation in the application. Once you do that whatever account is set as the specific user, those credentials would used to access local resources on that server (Not for external resources).
Specific User setting is specifically meant for accessing local resources.
I've moved my codebase to a new directory and need to grant the IIS account read/write privileges on a few folders to allow access by the ASP.Net runtime. I believe NETWORKSERVICE is no longer used for this purpose (as mentioned in this earlier question:
ASP.Net which user account running Web Service on IIS 7?) but, try as I might I can't seem to be able to add the IISAppPool/IIS Worker Process the article links to.
I've found a MyDomain/IIS_WPG account but this isn't the one that is listed in Task Manager for the w3wp process. Can someone help?
UPDATE:
Even odder - the Application Pool for the website in question uses the LocalSystem identity which I thought would be able to access pretty much the entire machine. Is there something incorrect about my basic machine/Windows setup?
I'm running Windows 7 SP 1 and have just turned on IIS 7. Just trying to access the default page it creates I get a 503 error, and the application pool stops. I look in the event log and I find the error:
Windows cannot copy file \?\C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\SQM\iesqmdata_setup0.sqm to location \?\C:\Users\TEMP.IIS APPPOOL.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\SQM\iesqmdata_setup0.sqm. This error may be caused by network problems or insufficient security rights.
DETAIL - Access is denied.
I tried making the TEMP.IIS APPPOOOL.000 folder available to everyone. I tried making Users available to everyone. No luck, it still dies with the same error.
What is happening here, and how can it be fixed?
It sounds like you're having the same problem as details in this IIS.NET forums thread. You didn't mention if you have x64 Windows 7 or not. Suspect that your development machine is misconfigured somehow; sounds like the uninstallation and reinstallation of IIS7 would help/fix.
Suggested courses of action:
Open IIS and its Application Pools. Open "DefaultAppPool" and any other Application Pools in use.
Click Advanced Settings for each of these. Ensure the "Load User Profile" is set to 'False'
Also ensure that the "Set Application Pool Defaults" has the Load User Profile set to False."
I encountered the same problem in my development environment (Windows 8.1). Instead of disabling the load user profile as suggested by P.Campbell, I went ahead and changed the permission of the sqm file to allow modify accesses for IUSR, IIS_IUSRS and Network Service. In my case, the sqm file was not able to show me the file owner in which I taken over with my user account.
Basically, my problem was solved by giving the correct permission for both source and destination files/folders.
Found the answer here - http://forums.iis.net/p/1180636/1992024.aspx
Open IIS Manager
Find the App Pool that is causing the problem
Open Advanced Properties
Change 'Load User Profile' to false
Fixed!
After struggling with all these Application Pool issues in IIs, I found the problem and the solution. This may help you.
Each application pool on each website in Microsoft's Internet Information Server creates its own user account and folder under the "c:\Users" directory when the pool is created and first run. Its actually a virtual user account and should be named for the Application Pool assigned to your web application in IIs. In most development environments, its the default website or "DefaultAppPool". It uses this temporary user account to run the pool. Each website should have a named user pool account. This User folder is used by the pool and ASP.NET for caching and writing of file resources and other things used by IIs, ASP.NET, and this virtual account.
In some setups people are not seeing this folder but a "TEMP" folder (like you have) when the IIs web site is accessed and using the pool.
If you instead see a "TEMP" folder in the Users folder you have a broken application pool account in IIs and in the Registry. The pool is creating the TEMP folder as a backup for this virtual account, which might not have the right security setup. I had this exact scenario.
To fix it go to the registry under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
See if you have a SID user account with the ".bak" extension for a DefaultAppPool user account. If so delete it and restart your PC. Test your website again, making sure its actually setup to use DefaulAppPool. It should now recreate the "DefaultAppPool" folder in Users, recreate the registry entry for DefaulAppPool user, and your error should go away.
You can delete the TEMP user folder at that point under the Users folder. (Keep in mind if your web app has been storing cached information critical to users of the website, some of that might have to be inserted into the new DefaultAppPool user folder. But for most of us, just delete it.)
I also found I had to add this kooky virtual application pool account to my local database so the worker process and app pool accnt could have the rights to grab data from SQL Server: Just go into SQL Server and under logins add "IIs AppPool\DefaultAppPool" and then assign it as a user to your databases.
(btw whomever dreamed up this virtual application pool account system is nuts....its way too complicated and convoluted to sort out)
After I did this, all my stack overflow errors went away in Visual Studio for my web application, all data connections fired perfectly, all write permission to the default User profile stored properly, and all the restarting and crashing of the Application Pool in IIs ended completely. :)