Granting write permissions to a networked UNC folder for ASP.NET under IIS 7.5 and Windows Server 2008 R2

Question

BLUF

Our application is attempting to write a file to a UNC folder using an ASP.NET web service running under .NET 4.5, IIS 7.5, and Windows Server 2008 R2. Howeve

Answer 1

I had similar problem accessing a network share using AppPoolIdentity in an ASP.NET application (access denied). Using NetworkService account or other domain account worked but these were not the best solution. I performed almost all the tests you did but finally found something that worked.

I figured out that the Network Service account was not used when accessing the shares, just like you did (i expected domain\machine$ account)

This worked for us: On your IIS web site, go to Authentication and change the Anonymous Authentication item to "Application Pool Identity". It's by default set to "IUSR". This solved our problem.

Also maybe activating ASP.NET impersonation (still in Authentication menu) may help.

Thibault

Answer 2

1. Reboot your 'mywebserver'.

2. Marvel at the now mysteriously functional ApplicationPoolIdentity.

3. Install MS HotFix KB2545850 and learn the details about this bug in KB2672809 which also shows the steps to reproduce and demonstrate this apparently random problem. Direct download link here.

4. Speculate why Microsoft has not managed to release a normal windows update for this in the 3 years since that hotfix was published. While people still continue running into it and pulling their hair out because of this obscure problem.

5. Learn about the other folks who have shared and enjoyed this gift from MS that still continues to keep on giving:

   • IIS application using application pool identity loses primary token?
   • DirectoryServicesCOMException 80072020 From IIS 7.5 Site Running Under ApplicationPoolIdentity
   • ApplicationPoolIdentity cannot access network resources
   • ApplicationPoolIdentity IIS 7.5 to SQL Server 2008 R2 not working
   • Windows Authentication Failed when using application pool identity
   • IIS 7.5 stops using machine account to connect to network resource when using AppPoolIdentity

Your Windows 7 dev machine probably worked fine because it reboots more often than the server. Congrats on your very well written and thorough bug report. I rarely see that here.

Answer 3

I have faced same issue, I resolved by creating one domain account for each environemt (QA, STAGE, PRODUCTION). In Application pool identity I have set custom account and I used domain user for respective account. Now It gives me the ability to write and read the files from UNC Path.