3

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to the various folders where these files are saved. I'm not sure how I should be granting permissions on particular folders so that the site users can do these things.

My understanding was, that I needed to grant write access to my defaultAppPool user on the folder where these files are saved (because it is defaultAppPool that my site is using), but this does not work. I also tried giving IIS_IUSRS write permission to the same folder but this also doesn't work.

The only way I got it to work was by granting write permission to the "Users" group, which includes "NTAUTHORITY\AuthenticatedUsers (S-1-5-11)" and "NT AUTHORITY\INTERACTIVE (S-1-5-4)" (and who are these guys?).

So I guess what I'm wondering is, which user are my site users actually using and what is the correct way to grant write permission to specific folders?

1

You may need to specifically type

 IIS AppPool\DefaultAppPool

Then click "check names" when granting privledges (see here: http://www.iis.net/learn/manage/configuring-security/application-pool-identities and even better, here: https://stackoverflow.com/questions/5437723/iis-apppoolidentity-and-file-system-write-access-permissions)

  • Thanks for your answer Jen, but the problem was not as you describe. I was able to grant the privilege to DefaultAppPool but it didn't work in the sense that users were still not able to upload files. As I said, I got it to work by assigning permissions to the Users group but my question was really "is this the right way to do it? Or is there a better way?". – Vincent Mar 6 '15 at 15:26
  • No, by doing that you are granting access to all users - so if you have other sites on your server you are opening a security hole. Is your site using basic authentication? – Jen R Mar 6 '15 at 15:30
  • I got it. With basic authentication now installed and enabled, granting the write privilege to the DefaultAppPool works as expected. So that was the problem all along. I didn't have basic authentication installed and enabled. – Vincent Mar 7 '15 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.