ApplicationPoolIdentity in IIS7 401 errors [closed]

Question

We have just started to use Windows Server 2008 R2 and IIS7.5 and I'm trying to move some existing sites across from our Windows 2003 box. I can get the sites running ok but am getting 401 errors for all the CSS / Images in the sites. Granting Everyone read access will solve this - but I'm not very happy doing this.

I've read that IIS7.5 makes use of a magical new 'account' and each Application Pool has its own account.

So far I have

• Created a new folder in wwwroot for my website (kbank)
• Copied the files in from another machine
• In IIS7 created a new website (not virtual directory), this created a new Application Pool with the same name as my website. This is an Integrated Pipeline pool
• In Process Model / Identity this is using ApplicationPoolIdentity and Load User Profile is set to True
• Granted IIS AppPool\kbank read access to the root of the folder

Can anyone tell me how best to set up my websites.

Reginaldreginauld

thanks for providing the link for the "magical new account", that was exactly what i was looking for. – Hahnert

Answer 1

Maybe you are just missing a small step. When you granted the account read access, did you check that it replaced settings in all subdirectories. Also it may require an IIS reset after changing the access rights.

Fovea

Hi Shiraz, Always worth checking these things, but no the permissions were updated on all subdirectories and a restart didn't make any difference. Simon – Reginaldreginauld

Why then was the answer accepted, pray tell? – Brownley

@Brownley resetting IIS didn't do the trick, but rebooting the server did. Quite a drastic step, not one I'm proud of, but that old IT adage of "Turn it off and on again" seems to have been the answer. Surely it shouldn't have been the case, but meh! – Reginaldreginauld

Answer 2

2008 R2 IIS 7.5

Just as an FYI. After rebuilding servers and spending endless hours troubleshooting a 401.3 error after changing the AppPool identity to a domain account, we came to find out that a GPO was killing IIS. Make sure you test with a server in the "Computer" container and that no GPO's are changing restricted groups outside of Administrators.

In our case, NT Authority\Authenticated Users was removed from the local USERS group and it broke IIS complete.

Sublimate

Answer 3

I would check what is the exact status code of the 401 error IIS 7 Status Code Once you know the exact error code, it will be easy for to troubleshoot the exact issue is.
I would also run Process Monitor and see if there are any "ACCESS DENIED" using the Filter.

Regards,
Vivek.

Hermilahermina

Hi Vivek I'm a bit lost - I've removed the everyone account and yet I'm now not getting 401 errors. I don't know whether there was a delay in the permissions being applied (though a restart should have dealt with that). Pleased that is resolved though! – Reginaldreginauld