Custom Account to Run ASP.NET on Windows 2003

[Drew]

On my W2kPro machine I have successfully create a Custom Account to
Run ASP.NET (see page 351 of the linked doc), and the application runs
under this new context.
http://msdn.microsoft.com/library/d...en-us/dnnetsec/html/SecNetHT01.asp?frame=true

However, I've tried to implement this on a Win2003 Server and am still
getting the page running under NT AUTHORITY\NETWORK SERVICE. I've
double-checked all my steps, rebooted the server, stopped and started
IIS Admin... still not working.

Is there anything different I have to do on W2k3 than on W2k?

 

[Ken Schaefer]

On Windows 2003 Server (and using the default IIS 6.0 Worker Process
Isolation Mode), ASP.NET uses whatever the web application pool's process
identity is set to. As you may notice, there is no separate aspnet_wp.exe
process - only various w3wp.exe processes. ASP.NET apps run inside these
w3wp.exe processes.

Cheers
Ken

: On my W2kPro machine I have successfully create a Custom Account to
: Run ASP.NET (see page 351 of the linked doc), and the application runs
: under this new context.
:
http://msdn.microsoft.com/library/d...en-us/dnnetsec/html/SecNetHT01.asp?frame=true
:
: However, I've tried to implement this on a Win2003 Server and am still
: getting the page running under NT AUTHORITY\NETWORK SERVICE. I've
: double-checked all my steps, rebooted the server, stopped and started
: IIS Admin... still not working.
:
: Is there anything different I have to do on W2k3 than on W2k?

 

[Drew]

I discover application pool, but that didn't resolve the problem.

But here is the solution. In IIS 6 there is a Windows Group called
IIS_WPG. The customASPNET account has to be added to this group in
order to work. This group (and this requirement) did not exist in IIS
5. The existence of this group is burried somewhere deep in the ms
documentation, but the purpose of it is not in IIS documentation that
I found.

Thanks,
Drew.

 

[Ken Schaefer]

Hi,

You original said that your app was running under Network Service. This is
because ASP.NET uses the configured web app pool identity.

If you want to use your own custom identity, you need to add it to IIS_WPG
(or manually give the permissions ot the IIS_WPG to the custom account).
This is documented in quite a few places. The IIS 6.0 Resource Kit has lots
of useful information like this, it is well worth reading if you have the
time. You can download it for free:
http://www.microsoft.com/downloads/...familyid=80A1B6E6-829E-49B7-8C02-333D9C148E69
or you can buy a hardcopy:
http://www.amazon.com/exec/obidos/A...0f-20?creative=125581&camp=2321&link_code=as1

Cheers
Ken

: I discover application pool, but that didn't resolve the problem.
:
: But here is the solution. In IIS 6 there is a Windows Group called
: IIS_WPG. The customASPNET account has to be added to this group in
: order to work. This group (and this requirement) did not exist in IIS
: 5. The existence of this group is burried somewhere deep in the ms
: documentation, but the purpose of it is not in IIS documentation that
: I found.
:
: Thanks,
: Drew.
:
:
: > On Windows 2003 Server (and using the default IIS 6.0 Worker Process
: > Isolation Mode), ASP.NET uses whatever the web application pool's
process
: > identity is set to. As you may notice, there is no separate
aspnet_wp.exe
: > process - only various w3wp.exe processes. ASP.NET apps run inside these
: > w3wp.exe processes.
: >
: > Cheers
: > Ken
: >
: > : > : On my W2kPro machine I have successfully create a Custom Account to
: > : Run ASP.NET (see page 351 of the linked doc), and the application runs
: > : under this new context.
: > :
: >
http://msdn.microsoft.com/library/d...en-us/dnnetsec/html/SecNetHT01.asp?frame=true
: > :
: > : However, I've tried to implement this on a Win2003 Server and am still
: > : getting the page running under NT AUTHORITY\NETWORK SERVICE. I've
: > : double-checked all my steps, rebooted the server, stopped and started
: > : IIS Admin... still not working.
: > :
: > : Is there anything different I have to do on W2k3 than on W2k?