Cannot read configuration file due to insufficient permissions

Question

I've recently encountered an error trying to host my asp.net site with IIS. I have found a solution that many swear by.

Solution:

1. Add IIS_IUSRS with Read permission on files in the folder
2. Change IIS authentication method to BasicAuthentication
3. refresh the website. It will work

(http://vivekthangaswamy.blogspot.com/2009/07/aspnet-website-cannot-read.html)

What do I add to my web.config file though? I've never had to edit it before. Here is its current contents:

<?xml version="1.0"?>
<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->
<configuration>
    <connectionStrings>
  <add name="DefaultConnection" connectionString="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Database.mdf;Integrated Security=True;User Instance=True"
   providerName="System.Data.SqlClient" />
 </connectionStrings>
 <system.web>
  <compilation debug="true" strict="false" explicit="true" targetFramework="4.0"/>
    </system.web>
</configuration>

My error is:

Config Error: Cannot read configuration file due to insufficient permissions
Config File: \?\C:\Users*****\Documents\Visual Studio2010\WebSites\PointsForTime\web.config

Effulgent

Please see the install rewrite module. save yourself some hours – Corvine

My solution would be to run the commands from command line opened with administrator privileges. To do this, find command prompt, right-click it, and click run with administrator privileges. – Vexed

In addition to the other answers, note that encrypting filesystem (EFS) can also interfere with IIS. – Bronwynbronx

I did this ad now local host is asking for a password, nearest I've getting so far to this working thanks – Unforgettable

For me there was no IIS_IUSR, I did the same for Authenticated User and it worked – Aiello

Answer 1

There is no problem with your web.config. Your web site runs under a process. In iis you can define the identity of that process. The identity that your web site's application pool runs as (Network Services, Local System, etc.), should have permission to access and read web.config file.

Update:

This updated answer is same as above, but a little longer and simpler and improved.

First of all: you don't have to change anything in your config file. It's OK. The problem is with windows file permissions.

This problems occurs because your application can not access and read web.config file.

Make the file accessible to IIS_IUSRS group. Just right click web.config and click properties, under security tab, add IIS_IUSRS.

So what is this IIS_IUSRS thing?

Your web site is like an exe file. Just like any exe file, it should be started by a user and it runs according to permissions assigned to that user.

When your site is started in IIS, Application Pool of your web site is associated with a user (Network Services, Local System, Etc. ...) (and can be changed in IIS)

So when you say IIS_IUSRS, it means any user (Network Services, Local System, Etc. ...) that your site is running as.

And as @Seph mentioned in comment below: If your computer is on a domain, remember that IIS_IUSRS group is a local group. Also make sure that when you're trying to find this user check the location it should be set to local computer and not a corporate domain.

Eggplant

For others, it's worth pointing out that the default usually is IIS_IUSRS and to make sure that when you're trying to find this user check the location it should be set to local computer and not a corporate domain. – Orangeism

How would one go about doing this? – Guenna

what Seph meant is you simply need to click "Path" and instead of whole directory choose your local machine. there you can find the IIS_IUSRS user. (I hope "Path" is the correct translation as I have german windows) – Analogous

Good answer, and here's an additional tip - running IIS7 on Win7 in a domain, you might not find IIS_IUSRS in the local group if you try finding with 'Check Names...'. Don't worry - just type IIS_IUSRS in full and hit OK, and all will be well. – Gilles

found out that you can click on a directory and add permission for everyone, by Right click on the specific folder(where your web.config is saved), tab on security, edit, and type Everyone and click on check name give it full control on every permission and Bingo! you are in business – Rosenblatt

@JackM: That is not a good idea because giving access to everyone can cause many security related problems. – Eggplant

it is everyone using the machine not opening the file to the www – Rosenblatt

@JackM I don't recommend it. For example: If you add everyone, in a shared hosting environment, other web sites can access your config file. – Eggplant

@AfshinGh: not that I am starting a new debate, but I am interested in how this can happen, the reason being that I use this kind of configuration on my local dev machine to mirror how my website will look like in a production environment as I am running the website from Project folder of VS2012, instead of running from inetpub as it will be on production – Rosenblatt

Adding this IIS_IUSRS group to the permissions didn't solve the problem for me (Win8.1). One of my websites works without my having done this. Subsequent websites that I've added, both totally new and exact copies of the first, working site, do not work. When I add the IIS_IUSRS group to the permissions for web.config (or alternatively, to the whole folder) simply makes the Chrome browser tab hang when trying to render the page. IE continues displaying the previous page. "Waiting for localhost" Any ideas? – Chem

I eventually got it to work by changing the Application Pool identity to "Local Service". I don't know if this is a problem, but it's only on my test box, and at this point I'm too frustrated to fight with it any more today. – Chem

What if you have a shared drive for the path of a site? Does this have an effect? How do you make this work with shared drives? – Magdau

I had to do this for IUSR. IIS_IUSRS didn't work for me for some reason. – Nyaya

While trying to setup a new ASP.Net web site from scratch in IIS 7 onward once you have fixed the error being discussed in this thread you might face an authorization error "HTTP Error 401.3 - Unauthorized" as your next hurdle. To fix that if you have enabled anonymous authentication then change the anonymous user identity from "IUSR" (set as default by IIS) to Application pool identity. To get the edit window for this setting use the "Edit" action from Actions pane in IIS features view for "Authentication" IIS feature. – Elma

@Orangeism To make it recognize IIS_IUSRS as a non domain-joined account, press Ctrl+Break from the Windows desktop, take note of your computer name, and then add the following user under the Web.config security settings: COMPUTER-NAME\IIS_IUSRS. – Izzard

You should also check for the read-only attribute in the applicationhost.config file – Outlandish

When I attempt to follow these steps by trying to add "IIS_IUSRS" to Web.Config's Group or user names in the Security tab, I get "Name Not Found - An object named "IIS_IUSRS" cannot be found..." – Pteropod

We had this recently, after installing a Microsoft security fix. It seemed to have removed the read-write Security permission for COMPUTERNAME\USERS on the IIS folder. We added back the permissions, and it all worked again. – Ripen

For me there was no IIS_IUSR, I did the same for Authenticated User and it worked – Aiello

@BhanuChhabra this is not a good idea. if you do this in a shared environment, you are granting access to other websites and processes on that server – Eggplant

@AfshinGh : My bad, forgot to mention it was my local dev/test env. Very true, not recommended for Production and Shared env. Thanks for mentioning. – Aiello

I had the same issue, but the problem was not the permissions to the website's folder, but the permissions of C:\inetpub – Melanesian

iis_user have full rights for intpub, what to do? What is going on whit this windows :D This privileges dose not matter at all... – Upstage

While we spent hours to figure out why our web.config could not be read, it turned out we had to install the .NET Core Hosting Bundle. It's a shame the error message didn't point us in that direction. – Valine

@AfshinGh same problem here but there are no "Security" options under my web.config file properties, I opened the properties from the web.config file in my RESTService project inside the solution in Visual Studio...Can I reach it from IIS manager alternatively? – Workout

@Workout right click the file in the windows explorer (windows file manager), not inside the visual studio. You need to set security permissions of the file. – Eggplant

thank you @AfshinGh! I tried it but I still get a 401.3 error :( – Workout

For me, it worked on giving permission to the entire folder of the artifact where the executable was residing to execute. – Demirep

Answer 2

I had what appeared to be the same permissions issue on the web.config file.

However, my problem was caused by IIS failing to load the config file because it contained URL rewrite rules and I hadn't installed the IIS URL rewrite module on the new server.

The solution was to install the rewrite module.

Solnit

Yup. The previous server I used this on rewrote the non ssl route to ssl.. so much for a great error message from IIS. error: :) +1 Because of instead of requiring SSL, I rewrote the URL to HTTPS incase someobody linked without https. What a conundrum. – Oran

thankyou!!! been faffing about with permissions for hours and it was down to this in the end! – Job

How does one go about installing the IIS URL rewrite module? – Pteropod

This was my issue as well--thanks! To install the rewrite module, download it from this page: iis.net/downloads/microsoft/url-rewrite close IIS, install, restart IIS (just to be safe). – Cyanate

@B.ClayShannon use the Web Platform Installer, search for IIS Rewrite – Laticialaticiferous

Didn't believe it could be this module in my case for a first instance, because I noticed the error only after performing a webdeploy and not when created a new site. Finally tried that and it worked! – Glarum

Yep, In my case it was URLRewrite module that was not installed. I spent a part of a day to find this. – Lighten

Answer 3

I had the same problem when I tried to share the site root folder with another user. Some folder lost the permission. So I followed the steps to add permission to IIS_IUSRS group as suggested by Afshin Gh. The problem is this group was not available for me. I am using windows 7.

What I did I just changed some steps:

1. Right click on the parent folder (who lost the permission),
2. Properties => Security =>In "Group or user names:",
3. Click Edit...
4. Window "Permission for your folder" will be opened.
5. In "Group or user names:" press ADD... btn,
6. Type Authen and press Check Names,
7. You will see the complete group name "Authenticated Users"
8. Press ok => apply.
9. This should enable privileges again.

That worked for me.

Eserine

Okay, I think I have an explanation for why this works. Some devs host their code at C:\ i.e. C:\Dev or C:\Code, etc. The security group Authenticated Users is granted on the C:\ and propagated to child folders. However, at the C:\Users folder, this propagation stops. So devs like myself who host their code inside the home folder have to grant access to Authenticated Users to those IIS root folders in order for IIS to work. – Cuttler

when I click check Names, it asks me credentials. I am not sure which user credentials are expected here.Can anybody help? – Flitting

Answer 4

Editor's note: Doing what this answer suggests: "changing Identity to LocalSystem" is DANGEROUS! The LocalSystem account is a ...

Completely trusted account, more so than the administrator account. There is nothing on a single box that this account cannot do, and it has the right to access the network as the machine (this requires Active Directory and granting the machine account permissions to something)

---

Changing the Identity from ApplicationPoolIdentity to LocalSystem did the work ;).

I am using win7 64 with IIS 7.5

more about Application Pool Identity in IIS 7.5 and win 7

Hallo

Useful answer for IIS 6 as well. Found more information about how to change Application Pool Identity at Microsoft website here: microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/… – Teledu

Making this change is a security risk because of the access you are granting this service: msdn.microsoft.com/en-us/library/windows/desktop/… – Megillah

This seems to have been my issue here and changing App Pool Identity to LocalSystem worked as described! – Trenna

Down-voting this due to the gaping security hole this leaves on the server. You should NEVER run public facing services like IIS under the local system account!!!! You are basically handing the keys to the kingdom for anyone that can hack the server. Seriously DO NOT DO THIS. – Dornick

How do you access this dialog? With my site highlighted in IIS7.5, the "Advanced Settings..." dialog that displays for me is much more spartan than what you show, and only has "General" and "Behavior" sections - no "Process Model". BTW, I don't have a "Local System" available in my list of options. – Pteropod

Had the same error with IIS 10 on WIndows 10 and this fixed it. Thanks! – Parietal

OMG This answer is SO INCORRECT for security. Moderation intervention is needed. This is a HORRIBLE idea. Imagine any file access that is specified on the querystring... boom... anybody can READ web.config and IIS will happily serve it to the world. DO NOT USE THIS ANSWER. – Laticialaticiferous

Changing the Identity from ApplicationPoolIdentity to LocalSystem did the work for me as well. thanks – Gluck

The author of this answer should really consider deleting it. – Mcconnell

Answer 5

Make the file accessible to the IIS_IUSRS group. Right click your web.config, expand properties, and under security tab, add IIS_IUSRS. Give the group read/write access.

When the group is NOT available, replace IIS_IUSRS by ComputerName\IIS_IUSRS

Fumatorium

+1 Good tip. The accepted answer is good, but neglects to mention that you might need to add your computer name in front of 'IIS_IUSRS', which is what got me past this. – Driblet

This ("When the group is NOT available") had my hopes up, but even when I prepended the computer name ("IBM-TAMMYFAYEBAKER.platypus.local\IIS_IUSRS") I still get the same error. I tried full computer name, too, but it wouldn't even accept that as a valid user. – Pteropod

Answer 6

You don't have to change anything in your web.config.

The problem is file system permissions. Your file permissions do not allow the IIS_IUSRS user to access web.config (or probably any of the files). Change their file permissions in windows to allow the IIS_IUSRS account to access it.

Karyolymph

I had a similar problem. If anyone ever can't find the IIS_IUSRS user, check the location. Mine defaulted to the corporate domain, so I didn't find it right away because I forgot to check to see where it was looking. – Oleviaolfaction

@Mystere Man I have the same issue. I changed the permissions and then tried. Still I get the same error. :( – Donalt

"(or probably any of the files)" works for me, allowing IIS_IUSRS account access to web.config is not enough, I need to enable it to have access to all files in the site helps. – Hypnotic

I had to do this for IUSR. IIS_IUSRS didn't work for me. – Nyaya

Thanks. I have granted 'Everyone' with full permission on the Web app folder and it works. – Isadoraisadore

Answer 7

When you grant permissions to IIS_IUSRS you should check that in the IIS/Authentication section of your Web Application, the Anonymous Authentication Credentials uses Application Pool Identity and not IUSR.

Calamint

Where can I get this interface? – Diuresis

In the Features View tab on your Web Application: Authentication – Calamint

This answer should be part of the accepted answer cause without this you also need to add IUSR in the access list of the website's folder – Attwood

Answer 8

Go to the parent folder, right-click and select Properties. Select the Security tab, edit the permissions and Add. Click on Advanced and the Find Now. Select IIS_IUSRS and click OK and OK again. Make sure you have check Write. Click OK and OK again.

Job done!

Concordance

What on earth is with recommending Write access when Read is all that's needed? /downvoted – Dhoti

The only IIS* I have is IIS_WPG – Pteropod

@B.ClayShannon Me too. I only have IIS_WPG – Ingenuous

Answer 9

For some reason your web.config is set as read only. Uncheck the readonly option of web.config file.

Elaterium

If your permission is full access and still get the error, this is the correct answer (y). – Upstage

Answer 10

I needed to add permissions to IUSR (in addition to ISS-IUSRS, as others have suggested). (See also: http://codeasp.net/blogs/raghav_khunger/microsoft-net/2099/iis-7-5-windows-7-http-error-401-3-unauthorized)

Trichology

Answer 11

Instead of giving access to all IIS users like IIS_IUSRS you can also give access only to the Application Pool Identity using the site. This is the recommended approach by Microsoft and more information can be found here:

https://support.microsoft.com/en-za/help/4466942/understanding-identities-in-iis

https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities

Fix:

Start by looking at Config File parameter above to determine the location that needs access. The entire publish folder in this case needs access. Right click on the folder and select properties and then the Security tab.

Click on Edit... and then Add....

Now look at Internet Information Services (IIS) Manager and Application Pools:

In my case my site runs under LocalTest Application Pool and then I enter the name IIS AppPool\LocalTest

Press Check Names and the user should be found.

Give the user the needed access (Default: Read & Execute, List folder contents and Read) and everything should work.

Untold

I tried giving read permissions for IIS_IUSRS and "Authenticated User", but it only worked after I gave it to my application app pool. – Hill

Answer 12

I used subst to create a mapping from D: to C: in order to keep the same setup as other developers in the team. This also gave me same errors as described. Removing this fixed it for me.

Madame

Answer 13

This happened to us when the IIS application has a Virtual Directory with a Physical Path that contains forward-slashes / instead of backslashes \. This was accidentally done using a powershell management API for IIS during our continuous delivery process.

Bad Config Example - applicationHost.config

<application path="/MySite/MyService" applicationPool="MyAppPool" enabledProtocols="http">
    <virtualDirectory path="/" physicalPath="C:\inetpub\MySite/MyService" />
</application>

Make sure the physicalPath attribute does not contain forward-slashes /, only backslashes \

Corrected Config Example - applicationHost.config

<application path="/MySite/MyService" applicationPool="MyAppPool" enabledProtocols="http">
    <virtualDirectory path="/" physicalPath="C:\inetpub\MySite\MyService" />
</application>

Toweling

In my case the physical path had a double back slash eg C:\inetpub\MySite\\MyService. Changing it to a single back slash worked – Laterite

Answer 14

Changing the Process Model Identity to LocalSystem fixed this issue for me. You can find this setting if you right click on the application pool and chose "Advanced Settings". I'm running IIS 7.5.

Leer

Answer 15

Shift your project to some drive other than C: Worked for me with the same error.

Lubra

Answer 16

The accepted solution didn't for me. I use a Git repo and it cloned to the following folder

c:\users\myusername\source\repos\myWebSite

I made new IIS website and pointed it at the path. Which didn't have the iis_iusrs permissions suggested in the accepted solution. When I added the permissions it still didn't work.

It only started working when I gave the following permissions to the 'Users' group and inheritance cascaded the permissions to web.config. Probably should have applied it just to the web.config to reduce attack surface area.

Stroller

Had exact the same situation. This helped. – Pollock

Answer 17

All answers given are valid and working under different circumstances.

For me, restarting Visual Studio worked.

Supposing

Answer 18

We had a website running with a specific identity in the apppool, only after giving that user read access to the folder containing the web.config would it work. We tracked this down after adding the 'everyone' user with read and everything worked fine.

Urbanize

Answer 19

For me the error turned up during Debugging on my local machine and turned out to be related to the base web.config, which is initiated by the .NET Framework when compiling the website. My C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config file had an unrecognized element (folderLevelBuildProviders). Fixing this fixed the 500.19 error.

See this: IIS Manager can't configure .NET Compilation on .NET 4 Applications

Phil

Answer 20

Right click Web.Config => Tab Security => Button Edit => Button Add => Button Advanced => Button Find Now = > In Search results select your group(in our case " IIS_IUSRS") => Ok => Ok=> Ok

Tilney

Answer 21

I have solved this by adding read permission to folder for application pool user (WIN SERVER 2008 R2): C:\Windows\System32\inetsrv\config

A little background: Our server has been hacked using classical error where app user had more permissions that it should (local admin).

To fix it we created new domain user that had only permissions on application folder, with min needed rights and assigned it as application pool user. than we hit in the issue and this was solution to our problems.

Distrustful

Answer 22

This can happen if your application is in a virtual directory and the path to the files is a mapped drive.

If you change the path to the files to a local drive, this will solve it, if that indeed is your problem.

Corona

Answer 23

The above answers were helpful, but in case this helps anyone - I had this exact problem, and it turned out that I was (windows networking) sharing the root folder that the site was being hosted from. We killed the share, and added the Users permission to read/execute and it worked again just fine.

I suspect the share messed it up.

Wakerobin

Answer 24

I was receiving the "Cannot read configuration file due to insufficient permissions" as well. Turns out the ISAPI and CGI Restrictions in IIS for both ASP.NET 4.0 32bit and 64bit was set to deny. Marking them both to Allowed fixed my problem.

Giesser

Answer 25

Had this issue with a Virtual Application. All the permissions were set. IIS_IUSRS, AppPoolIdentity and then gave full access to Everyone. Nothing worked. Restarted apppool, site and IIS but No go.

Deleted the virtual application and added it again from scratch and it started working.

Wish I knew what solved it.

Etiology

Answer 26

check if the file is not marked as read-only, despite of the IIS_IUSRS permission it will display the same message.

Jesusa

Answer 27

I had this error message that turned out to be due to my physical folder being located on a network drive as opposed to the local drive. It seems the permissions on such drives by default can be different. For example, while the local drive location gave permission to the users of the local computer, the network location did not.

Further, the accepted answer does not work for such a case. The local users or IIS users were not an available to assign permissions to. The solution was to move the physical folder to the local drive.

Constrictive

Answer 28

I had the same issue and after doing all the stuff written here as answers, it still reproduced. The second half of the issue was the fact that .NET was turned off under "Turn Windows features on or off"

Threedecker

Answer 29

In my case, I was trying to host pages from a mapped drive (subst). The issue is that the subst was run under my account and the IIS user is not able to see the same drive

Escape

Answer 30

Sometimes if it is a new server you need to configure or install ASP.NET feature on IIS for it to be able to read your web.config file.

In my case this was the reason.

Upanddown

Answer 31

I gave permission and used ICACLS.exe but didn't work. Then I changed the physical path and it worked successfully.

(IIS 8.5 windows 2012 R2)

Lunseth

Answer 32

Certainly, this is an issue with permissions. I took following steps and it worked for me.

1. select your website or application in left corner. In most cases it would be under Default web site.
2. click on Basic settings on right corner in IIS Manager 7 or above.
3. click connect as button.
4. Use "Specific User", Click on set button.
5. Enter your username and password. like Domain\username. for me it was like ABC\rrajkumar, enter password.
6. restart IIS, browse your website. It should work now.

Toneme

Answer 33

1. Go to IIS, (sites)
2. Right click on project inside the sites.enter image description here

and click on edit permission.

3. Go to security.

4. click on edit button.

5. click add button. type COMPUTER_NAME\IIS_USERS

   or

6. click advance.

7. click find now button.

   and there is option to choose. choose IIS_USERS and click ok...ok....ok .

Luehrmann

Answer 34

I had this same issue and none of these solutions worked for me. I kept getting the same error and one about "Failed to start monitoring changes" in the event viewer.

The only thing that worked was to copy the folder and rename it back. It must have been a corrupted folder in Windows that IIS/ASP.NET could not access.

Isisiskenderun

Answer 35

Make sure your web.config file is not marked Read-only

Saad

Answer 36

I had this issue running on Windows 10 with the App Pool using a microsoftaccount\[email protected] account (e.g., signing in to the PC with a Microsoft Account instead of local account).

Apparently on my computer something got corrupted; removing IIS and re-adding it did nothing (because it seems the IIS metabase was not removed). Deleting and recreating the app pool didn't help either.

My solution was just to create a new App Pool with the same settings but a different name. This fixed the issue for me; apparently something got corrupted with the apppool which even deleting it and re-adding it with the same name would not fix.

Peccable

Answer 37

I was running a website at localhost/MyApp built and run through Visual Studio - via a Virtual Directory created by Visual Studio itself.

The "solution" for me was to delete the Virtual Directory and let Visual Studio recreate it.

Wilen

Answer 38

I tried most of the previous suggestions but in vain. I can't reload the website, so I edited the .csproj file and changed the port number and it worked immediately:

 <WebProjectProperties>
      <UseIIS>True</UseIIS>
      <AutoAssignPort>True</AutoAssignPort>
      <DevelopmentServerPort>**4000**</DevelopmentServerPort>
      <DevelopmentServerVPath>/</DevelopmentServerVPath>
      <IISUrl>http://localhost:**4000**/</IISUrl>
      <NTLMAuthentication>False</NTLMAuthentication>
      <UseCustomServer>False</UseCustomServer>
      <CustomServerUrl>
      </CustomServerUrl>
      <SaveServerSettingsInUserFile>False</SaveServerSettingsInUserFile>
    </WebProjectProperties>

Editing .csproj file

Yelmene

Answer 39

I set the .NET CLR version to No Managed Code and everything started to work fine.

Malfeasance

Answer 40

In some cases the web.config file isn't in the correct format.

Open the web.config file and check all XML tags. (For example, by putting the following codes in the web.config, if the project is executed, then the problem is from it)

<?xml version="1.0" encoding="utf-8"?>
<configuration>
</configuration>

Thenar