Add IIS AppPool\ASP.NET v4.0 to local windows group

问题

I'm trying to script with PowerShell the act of adding the user IIS AppPool\ASP.NET v4.0 to the Performance Monitor Users group, to be able to use custom performance counters from an ASP.NET application. But, I can't figure out how to address the automatically created ASP.NET user using ADSI.

This works for me:

 $computer = $env:COMPUTERNAME;

 $user = [ADSI]"WinNT://$computer/Administrator,user" 
 $groupToAddTo = "TestGroup"

 $parent = [ADSI]"WinNT://$computer/$groupToAddTo,group" 
 $parent.Add($user.Path)

However, I can't figure out how to find the ASP.NET v4.0 user:

 $computer = $env:COMPUTERNAME;
 # $user = [ADSI]"WinNT://$computer/IIS AppPool/ASP.NET v4.0,user" # <-- Doesn't work

 $groupToAddTo = "TestGroup"

 $parent = [ADSI]"WinNT://$computer/$groupToAddTo,group" 
 $parent.Add($user.Path)

Any clues on how to address that user using ADSI? Or, any other brilliant ways to achieve what I want using Powershell or other command-line tools? GUI works fine, however, automation is the key here.

回答1:

The following PowerShell script will add the application pool "ASP.NET v4.0" to the group "Performance Monitor Users"

$group = [ADSI]"WinNT://$Env:ComputerName/Performance Monitor Users,group"
$ntAccount = New-Object System.Security.Principal.NTAccount("IIS APPPOOL\ASP.NET v4.0")
$strSID = $ntAccount.Translate([System.Security.Principal.SecurityIdentifier])
$user = [ADSI]"WinNT://$strSID"
$group.Add($user.Path)

Unlike the net localgroup command, this script will work fine with app pool names longer than 20 characters.

来源：https://stackoverflow.com/questions/18208890/add-iis-apppool-asp-net-v4-0-to-local-windows-group