IIS application using application pool identity loses primary token?

Question

(This is a question about a vague problem. I try to present all relevant data, in the hope that someone has helpful information; apologies for the long description.)

<

Answer 1

Through Microsoft Support I found out that we ran into the issue described in Microsoft Knowledge Base article KB2545850. This only occurs when ApplicationPoolIdentity is used. It occurs very easily, namely, after the machine account password is changed (which by default happens automatically every 30 days), and then IIS is restarted (e.g., through iisreset). Note that the problem goes away after a reboot, according to Microsoft and our observations.

According to Microsoft it is not possible to check if your Windows/IIS has gotten into this state.

Microsoft has a hotfix attached to this KB article. There is no indication when that hotfix will be rolled into an official delivery, and the hotfix is already 10 months old. In our specific case, we decided to switch to NetworkService instead.

Answer 2

See https://serverfault.com/a/403534/126432 for my comments on the same problem/solution.

Using the hotfix you linked to allowed me to get ApplicationPoolIdentity working as the docs say it should. This hotfix doesn't specifically describe a solution for accessing network resources as NT AUTHORITY\ANONYMOUS LOGON, but it's related to the computer password changing. Bottom line is that it worked for me, at least so far.

Answer 3

This is also relevant for Umbraco using Active Directory authentication. From time-to-time you may get this exception:

Configuration Error

The specified directory service attribute or value does not exist

This is apparently caused by the problem outlined here. A reboot invariably fixes it.