3

Using Windows Server 2012 and IIS 8, I want my site users to be able to upload pictures and generate eft files and export files etc. All of these tasks require my users to have write permission to the various folders where these files are saved. I'm not sure how I should be granting permissions on particular folders so that the site users can do these things.

My understanding was, that I needed to grant write access to my defaultAppPool user on the folder where these files are saved (because it is defaultAppPool that my site is using), but this does not work. I also tried giving IIS_IUSRS write permission to the same folder but this also doesn't work.

The only way I got it to work was by granting write permission to the "Users" group, which includes "NTAUTHORITY\AuthenticatedUsers (S-1-5-11)" and "NT AUTHORITY\INTERACTIVE (S-1-5-4)" (and who are these guys?).

So I guess what I'm wondering is, which user are my site users actually using and what is the correct way to grant write permission to specific folders?

Improve this question

1 Answer 1

Reset to default
1

You may need to specifically type 

 IIS AppPool\DefaultAppPool

Then click "check names" when granting privledges (see here: http://www.iis.net/learn/manage/configuring-security/application-pool-identities and even better, here: https://stackoverflow.com/questions/5437723/iis-apppoolidentity-and-file-system-write-access-permissions)

Improve this answer
3
  • Thanks for your answer Jen, but the problem was not as you describe. I was able to grant the privilege to DefaultAppPool but it didn't work in the sense that users were still not able to upload files. As I said, I got it to work by assigning permissions to the Users group but my question was really "is this the right way to do it? Or is there a better way?".
    – Vincent
    Mar 6, 2015 at 15:26
  • No, by doing that you are granting access to all users - so if you have other sites on your server you are opening a security hole. Is your site using basic authentication?
    – Jen R
    Mar 6, 2015 at 15:30
  • I got it. With basic authentication now installed and enabled, granting the write privilege to the DefaultAppPool works as expected. So that was the problem all along. I didn't have basic authentication installed and enabled.
    – Vincent
    Mar 7, 2015 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.