« Previous Next »

Answered Thread: IIS 6.0 Applicaiton Pool Identity

Last post 11-04-2009 5:17 AM by WenJun Zhang - MSFT. 4 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (5 items)

Sort Posts:

  • 10-29-2009, 2:10 AM

    IIS 6.0 Applicaiton Pool Identity

    Hi,

    I am trying to configure my IIS Application Pool to run as a domain account.  When I use a Domain Admin or NETWORK SERVICE the web site works fine.  When I use a normal user account that is member of Domain Users and the local IIS_WPG then application fails.

     I gave the domain account the following rights:

    • Adjust memory quotas for a process
    • Generate security audits
    • Log on as a service
    • Replace process level token
    • Impersonate a client after authentication
    • Allow logon locally
    • Access this computer from the network
    But this hasn't improved the situation.  If I add the user to the local Administrators group in the IIS server and restart IIS then it works.  What other rights or permissions do I need to add to get this to work?

     

  • 10-29-2009, 2:22 AM In reply to

    Re: IIS 6.0 Applicaiton Pool Identity

    What do you mean by fails? What is the error message?

    Do you see any events in event viewer related to app pool?

    Have you ensured that the username/password you have entered it correctly?

    HTH.

    ~ Ganesh

  • 10-29-2009, 3:03 AM In reply to

    Re: IIS 6.0 Applicaiton Pool Identity

     Well the username and password must have been entered correctly since changing the account's membership to the local administrators group without any other change causes the application to work.  Also the w3wp.exe can be seen running as that account.  Thanks for asking these questions because redacting information from the event log caused me to see the error.  We have encrypted sensitive section of the web.config and the user doesn't have the access required to decrypt.

    The error displayed to the user is:

    <!-- Web.Config Configuration File -->

    <configuration>
        <system.web>
            <customErrors mode="Off"/>
        </system.web>
    </configuration>

     And in the event log:

    Event Type:    Warning
    Event Source:    ASP.NET 2.0.50727.0
    Event Category:    Web Event
    Event ID:    1310
    Date:        29/10/2009
    Time:        6:00:49 PM
    User:        N/A
    Computer:   
    Description:
    Event code: 3008
    Event message: A configuration error has occurred.
    Event time: 29/10/2009 6:00:49 PM
    Event time (UTC): 29/10/2009 7:00:49 AM
    Event ID: 3a031bbf65c9470989885e5b05096042
    Event sequence: 1
    Event occurrence: 1
    Event detail code: 0
     
    Application information:
        Application domain: /LM/w3svc/2/ROOT-1-129012732357915783
        Trust level: Full
        Application Virtual Path: /
        Application Path:
        Machine name:
     
    Process information:
        Process ID: 2344
        Process name: w3wp.exe
        Account name:
     
    Exception information:
        Exception type: ConfigurationErrorsException
        Exception message: Failed to decrypt using provider 'RsaProtectedConfigurationProvider'. Error message from the provider: The RSA key container could not be opened. ()
     

  • 10-29-2009, 10:00 AM In reply to

    Answered Re: IIS 6.0 Applicaiton Pool Identity

    I hope the custom identity is part IIS_WPG group, If not, please add it.

    And run following command from the framework folder.

    aspnet_regiis -pa NetFrameworkConfigurationKey IIS_WPG

    And/Or

    aspnet_regiis -pa NetFrameworkConfigurationKey domain\user

    Some info here
    http://msdn2.microsoft.com/en-us/library/ms998283.aspx 

    HTH.

    ~ Ganesh

  • 11-04-2009, 5:17 AM In reply to

    Re: IIS 6.0 Applicaiton Pool Identity

    Also please refer to the permissions which Network Service has(listed in below article).

    Default permissions and user rights for IIS 6.0
    http://support.microsoft.com/?id=812614

     

    WenJun Zhang - MSFT
    Sincerely
    Microsoft Online Community Support

    “Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
Page 1 of 1 (5 items)
Microsoft Communities