Does a domain user being used as an app pool identity need to exist on the server in order to have access to a network folder?

pileup

5/30/24, 5:11 PM

Running IIS 10, I used a domain user as the application pool identity: my-company/custom_app_pool_identity

But it was also given a local administrator, so I completely removed that user from the server itself (Didn't want an identity to also be a local administrator - you can see its password using the appcmd command)

In the code (PHP), it accesses a network folder, X:/some_folder.

The website that this app pool runs then display the files from that folder, but if not, it just doesn't display anything (No error if no access).

But now, after the removal, I can't see any files which probably means the app does not have access to X:/some_folder. Because in the local dev environment, I do see the files. (It's weird because it did work right after the removal, so maybe it was cached?)

But - I was sure that I can completely remove the domain user from the server itself, because it's a domain user, so if this user is added to the allowed user of that network folder, then when the app is run by IIS with the identity my-company/custom_app_pool_identity, it should work? Or, if I run any identity with IIS under a custom user, I also need that user to be present on the server itself?

If so, should I just add it back to the server and give it the right permissions (And not Admnin)?

Update: I just checked the folder Security (in Properties), from some reason, the domain user was removed from the Users list there. When I re-added the domain user again and gave him the right permissions, it came back to work. So I can confirm that it works even if the user does not exist as a local user on the server. I just wonder why it disappred from the Users list because it was there before I removed the users from local admins

0 + 4

windows

iis

application-pools

djdomi

5/30/24, 9:01 PM

adding to local administrator is never a good solution. starting with afaik 2016 there are existing managed service user where the password does not need to be known as it is managing by the ad, and yes you need to give the user read permission to the folder

pileup

5/30/24, 9:54 PM

thank you, I need to try ask to get a managed service user instead of a normal user as you said. Bur regarding the user itself - it is not a local user on the server and it still works

Lex Li

6/1/24, 4:21 AM

1) You need to learn from your domain administrators what is a domain user. 2) Adding a domain user to local administrators or Users group does not mean that user "exists" on the machine nor make it "a local user on the server". 3) Mapped drives like `X:` are not supported by IIS, so if the pool identity was added to local administrators group to bypass that limitation then you know how bad that trick is. Please switch to UNC paths, and grant the right permissions on the remote file share.

pileup

6/3/24, 3:34 PM

I eventually told them to create an MSA user which worked!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Does a domain user being used as an app pool identity need to exist on the server in order to have access to a network folder?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.