Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 537
  • Last Modified:

IIS 7.5 ApplicationPoolIdentity

All my web apps for Windows 2008 R2 IIS 7.5 are running with ApplicationPoolIdentity, should I change this or leaving the default option as it is

Can you give me an over view of Identities and what function do they perform
0
rakkad
Asked:
rakkad
  • 2
  • 2
1 Solution
 
becraigCommented:
Depending on the nature of your application.

However it is best practice to run your apps under an identity for issues such as impersonation and DB connectivity where there might be security concerns.

Here is a more lengthy explanation:

http://blogs.technet.com/b/tristank/archive/2011/12/22/iusr-vs-application-pool-identity-why-use-either.aspx
0
 
rakkadAuthor Commented:
Am still confused about the article,

What does the default ApplicationPoolIdentity do ?
0
 
becraigCommented:
If you have an application it can run as any user.

The identity allows you access aspect of the system and your network that SHOULD NOT be available to your IIS default user accounts.

If you do not utilize an identity for your application then you will have to worry about security issues where granting access to the application will require granting access to built in account.

This is NOT A SECURE model, it is best practice to run applications under an identity.
If you application needs to write a file it is easier to grant access to a secure (non-builtin user) than to grant access to a built in user that could be spoofed by an intruder.

The concept as well of an application pool identity is to ensure there is secure isolation for folders used by the app, there is no need to grant EVERYONE or NETWORK SERVICE etc access to application related folders which can lead to system compromise.

The long and short of it is, the application pool identity is an identity that allows your application to interact with your system and network etc in a controlled not easily manipulated manner.

As the article says
Using the App Pool Account as anonymous is a good idea because it allows you to secure your content at the NTFS level for just COMPUTER\Coke or IIS AppPool\Pepsi, and be assured that Windows file system security will prevent one company's anonymous app from reading (or otherwise affecting) its competitor's anonymous content.
0
 
David Johnson, CD, MVPOwnerCommented:
If your common app pool recycles then all sessions will recycle. If you have several websites this could be a problem.  If each website has its own apppool then a problem with one website won't affect the others.
0
 
rakkadAuthor Commented:
This proved useful and clarified my answer

Thanks
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now