ApplicationPoolIdentity in IIS7 401 errors [closed]

Question

We have just started to use Windows Server 2008 R2 and IIS7.5 and I'm trying to move some existing sites across from our Windows 2003 box. I can get the sites running ok but am getting 401 errors for all the CSS / Images in the sites. Granting Everyone read access will solve this - but I'm not very happy doing this.

I've read that IIS7.5 makes use of a magical new 'account' and each Application Pool has its own account.

So far I have

• Created a new folder in wwwroot for my website (kbank)
• Copied the files in from another machine
• In IIS7 created a new website (not virtual directory), this created a new Application Pool with the same name as my website. This is an Integrated Pipeline pool
• In Process Model / Identity this is using ApplicationPoolIdentity and Load User Profile is set to True
• Granted IIS AppPool\kbank read access to the root of the folder

Can anyone tell me how best to set up my websites.

Answer 1

Maybe you are just missing a small step. When you granted the account read access, did you check that it replaced settings in all subdirectories. Also it may require an IIS reset after changing the access rights.

Answer 2

2008 R2 IIS 7.5

Just as an FYI. After rebuilding servers and spending endless hours troubleshooting a 401.3 error after changing the AppPool identity to a domain account, we came to find out that a GPO was killing IIS. Make sure you test with a server in the "Computer" container and that no GPO's are changing restricted groups outside of Administrators.

In our case, NT Authority\Authenticated Users was removed from the local USERS group and it broke IIS complete.

Answer 3

I would check what is the exact status code of the 401 error IIS 7 Status Code Once you know the exact error code, it will be easy for to troubleshoot the exact issue is.
I would also run Process Monitor and see if there are any "ACCESS DENIED" using the Filter.

Regards,
Vivek.