To solve the IIS application pool authentication account permission problem, first, you need to confirm the identity account used by the application pool. The default is IIS AppPool{AppPoolName}, which can be viewed or modified through IIS Manager; secondly, make sure that the account has corresponding permissions to the website physical path (such as D:\MyWebSite). The operation steps are: Right-click the folder → Properties → Security → Edit → Add the corresponding account and set read, write and other permissions; common errors such as 401.3 are due to lack of read permissions, 500.19 may be due to insufficient permissions for web.config file, and failure to upload may be due to lack of write permissions; pay attention to whether the inheritance permissions are effective, the UNC path needs to be configured with a username and password, and the application pool may be restarted after modification.

In IIS, the Application Pool Identity account (Application Pool Identity) determines which resources the websites under the application pool can access. If the permissions are set improperly, it may cause 401, 500 errors, or problems such as not being able to read and write specific folders. The core of this problem is to ensure that the identity account used by the application pool has the correct file system permissions to the relevant directories .

The following is a few common scenarios to talk about how to deal with these problems.

How to confirm which identity account is currently using for the application pool?

By default, IIS assigns a virtual account to each app pool in the format IIS AppPool\{AppPoolName} . You can view it in the following ways:

• Open IIS Manager
• Go to the "Application Pool" on the left
• Right-click the corresponding application pool → “Advanced Settings”
• View the "Identification" in the "Process Model" section

You can also manually modify this account, such as changing it to LocalSystem or custom domain account, but it is recommended to use the default virtual account first because it is safer.

Tip: Don't change it to LocalSystem casually. Although it has high authority, it will bring security risks.

How to add folder access permissions to the application pool account?

When you deploy a website, such as D:\MyWebSite , and the website needs to read or write certain files, you must ensure that the corresponding AppPool account has permissions to the directory.

The operation steps are as follows:

• Right-click the target folder → Properties → Security tab
• Click "Edit" to change permissions
• Add user: Enter IIS AppPool\YourAppPoolName
• Check the appropriate permissions, such as "Read & Execute", "List folder content", and "Read". If there is any writing requirement, check "Write"

Note: If you have changed your application pool account, such as changing it to another user, you must reset the permissions, otherwise an error will occur during website access.

Common errors and troubleshooting methods

Page error 401.3: No permission to access the path

This is usually because the application pool identity does not have read permissions to the website's physical path. Check the physical path bound to your website and confirm whether the path allows access to the application pool account.

Error HTTP 500.19 Internal Server Error

This error is not necessarily a permission problem, but if you see information that the configuration file fails to load, it may also be that IIS cannot read the web.config file. At this time, you must also check the permissions of the directory where the file is located.

The application runs normally, but upload/write files failed

This situation shows that the application pool account only has read permissions, but lacks write permissions. You can add "write" permissions to upload directories (such as App_Data or Uploads ) separately.

Some details that are easy to ignore

• Inheritance permissions : If a newly created website directory inherits permissions from the previous directory, it may already contain appropriate access controls, but if you copy or move the directory, the inheritance relationship may be broken.
• UNC path access : If your website points to a network path (such as a shared folder), you also need to set the username and password in the "Process Model" of "Advanced Settings", otherwise it will not be authenticated.
• Is the application pool still not effective? : Sometimes even if the permissions are changed, you need to restart the application pool or IIS to see the effect.

Basically that's it. As long as you figure out who is running the application pool and whether it has access to the path, most problems can be solved.

The above is the detailed content of Managing Application Pool Identities and Associated File System Permissions for IIS. For more information, please follow other related articles on the PHP Chinese website!