blocks|key|3038380|text|@EvilDr您可以在AD环境中创建一个IUSR_identifier帐户，并让特定的应用程序池在该IUSR_identifier帐户下运行：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3038381|“应用程序池”>“高级设置”>“身份”>“自定义帐户”|3038382|在“高级设置”中，将您的网站设置为“应用用户(传递身份验证)”，而不是“特定用户”。|3038383|现在，为该IUSR_identifier提供对文件和文件夹的适当的NTFS权限，例如:对companydata进行修改。|3038384|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

@EvilDr
You can create an IUSR_[identifier] account within your AD environment and let the particular application pool run under that IUSR_[identifier] account:

"Application pool" > "Advanced Settings" > "Identity" > "Custom account"

Set your website to "Applicaton user (pass-through authentication)" and not "Specific user", in the Advanced Settings.

Now give that IUSR_[identifier] the appropriate NTFS permissions on files and folders, for example: modify on companydata.

blocks|key|195538|text|我将使用特定用户(而不是应用程序用户)。然后，我将在应用程序中启用模拟。完成此操作后，无论设置为特定用户的帐户是什么，这些凭据都将用于访问该服务器上的本地资源(而不是外部资源)。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|195539|特定的用户设置专门用于访问本地资源。|195540|entityMap^0|23|4|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|N|8|@]|D|@]|E|$]]]|I|$]]

I would use specific user (and NOT Application user). Then I will enable impersonation in the application. Once you do that whatever account is set as the specific user, those credentials would used to access local resources on that server (Not for external resources). 

Specific User setting is specifically meant for accessing local resources.

blocks|key|198115|text|IUSR是IIS_IUSER+group.so的一部分，我想你可以不用担心就可以删除IUSR的权限。Further+Reading|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|198116|然而，随着时间的推移，随着越来越多的Windows系统服务开始以NETWORKSERVICE的形式运行，出现了一个问题。这是因为作为NETWORKSERVICE运行的服务可以篡改以相同身份运行的其他服务。因为IIS工作进程在默认情况下运行第三方代码(Classic+ASP、ASP.NET、PHP代码)，所以现在应该将IIS工作进程与其他Windows系统服务隔离开来，并以唯一标识运行IIS工作进程。Windows操作系统提供了一种称为“虚拟帐户”的功能，该功能允许IIS为其每个应用程序池创建唯一标识。默认情况下，DefaultAppPool是分配给您创建的所有应用程序池的池。|198117|若要使其更安全，可以将IIS标识更改为ApplicationPoolIdentity。|198118|关于权限，Create和Delete总结了可以授予的所有权限。因此，无论您分配给IIS_USERS组的是什么，他们都将需要。没有更多，没有更少。|198119|希望这能有所帮助。|198120|entityMap|0|LINK|mutability|MUTABLE|url|http://www.iis.net/learn/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis^0|1E|F|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|D|3|E|5|6|7|X|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|Y|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|Z|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|10|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|11|8|@]|9|@]|C|$]]]|M|$N|$5|O|P|Q|C|$R|S]]]]

IUSR is part of IIS_IUSER group.so i guess you can remove the permissions for IUSR without worrying. <a href="http://www.iis.net/learn/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis" rel="noreferrer">Further Reading</a>

However, a problem arose over time as more and more Windows system services started to run as NETWORKSERVICE. This is because services running as NETWORKSERVICE can tamper with other services that run under the same identity. Because IIS worker processes run third-party code by default (Classic ASP, ASP.NET, PHP code), it was time to isolate IIS worker processes from other Windows system services and run IIS worker processes under unique identities. The Windows operating system provides a feature called "Virtual Accounts" that allows IIS to create unique identities for each of its Application Pools. DefaultAppPool is the by default pool that is assigned to all Application Pool you create. 

To make it more secure you can change the IIS DefaultAppPool Identity to ApplicationPoolIdentity. 

Regarding permission, Create and Delete summarizes all the rights that can be given. So whatever you have assigned to the IIS_USERS group is that they will require. Nothing more, nothing less. 

hope this helps.

blocks|key|3038485|text|当我将IIS_IUSRS权限添加到站点文件夹时，像js和css这样的资源仍然是不可访问的(错误401，禁止)。然而，当我添加IUSR时，它变得没问题了。所以可以肯定的是，“你不能不担心地移除IUSR的权限”，亲爱的@Travis+G@|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3038486|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

When I added IIS_IUSRS permission to site folder - resources, like js and css, still were unaccessible (error 401, forbidden). However, when I added IUSR - it became ok. So for sure "you CANNOT remove the permissions for IUSR without worrying", dear @Travis G@

blocks|key|3038619|text|我讨厌发布我自己的答案，但最近的一些答案忽略了我在自己的问题中发布的解决方案，这表明了一些方法是愚蠢的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3038620|简而言之，您不需要在所有中编辑任何用户帐户权限。这样做只会带来风险。该过程完全在IIS中使用继承的权限进行管理。|offset|length|style|BOLD|3038621|将修改/写入权限应用于正确的用户帐户|3038622|当该域出现在站点列表下时，|3038623|右键单击域，然后选择编辑权限|ordered-list-item|3038624|3038625|📷|atomic|3038626|在安全选项卡下，您将看到列出了MACHINE_NAME\IIS_IUSRS。这意味着IIS自动拥有该目录的只读权限(例如，在站点中运行ASP.Net+)。您不需要编辑此条目。|CODE|3038627|3038628|​|3038629|3038630|单击编辑按钮，然后添加...|3038631|在文本框中输入IIS+AppPool\MyApplicationPoolName，将MyApplicationPoolName替换为您的域名或访问您站点的任何应用程序池，例如IIS+AppPool\mydomain.com|3038632|3038633|3038634|3038635|3038636|按Check+Names按钮。您键入的文本将进行转换(请注意下划线)：|3038637|3038638|3038639|3038640|3038641|按OK添加用户|3038642|并选择新用户(您的域)，现在您可以安全地为|3038643|提供任何修改或写入权限|3038644|3038645|3038646|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/bbab7a27dc7a7c1042048c28fad32849.png|imageAlt|1|https://ask.qcloudimg.com/http-save/yehe-900000/b1bca369c0428609c062af4c93aa49d7.png|2|https://ask.qcloudimg.com/http-save/yehe-900000/8b6314787c11f6c32ee5b7c857cbdec3.png|3|https://ask.qcloudimg.com/http-save/yehe-900000/9c3d5ae945b9bc96ef95c37533fbcaac.png|4|https://ask.qcloudimg.com/http-save/yehe-900000/0ee649ea51be24a4be5d1ac08e188522.png^0|0|H|13|0|0|I|0|0|D|0|0|E|0|0|0|1|0|1|0|0|0|2E|F|M|0|0|1|1|0|0|0|0|7|X|16|L|2F|O|0|0|0|1|2|0|0|0|0|0|0|1|3|0|0|0|0|0|0|0|1|4|0|0^^$0|@$1|2|3|4|5|6|7|22|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|23|8|@$D|24|E|25|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|26|8|@$D|27|E|28|F|G]]|9|@]|A|$]]|$1|J|3|K|5|6|7|29|8|@$D|2A|E|2B|F|G]]|9|@]|A|$]]|$1|L|3|M|5|N|7|2C|8|@$D|2D|E|2E|F|G]]|9|@]|A|$]]|$1|O|3|-4|5|6|7|2F|8|@]|9|@]|A|$]]|$1|P|3|Q|5|R|7|2G|8|@$D|2H|E|2I|F|G]]|9|@$D|2J|E|2K|1|2L]]|A|$]]|$1|S|3|T|5|6|7|2M|8|@$D|2N|E|2O|F|G]|$D|2P|E|2Q|F|U]]|9|@]|A|$]]|$1|V|3|Q|5|R|7|2R|8|@]|9|@$D|2S|E|2T|1|2U]]|A|$]]|$1|W|3|X|5|6|7|2V|8|@]|9|@]|A|$]]|$1|Y|3|-4|5|6|7|2W|8|@]|9|@]|A|$]]|$1|Z|3|10|5|N|7|2X|8|@]|9|@]|A|$]]|$1|11|3|12|5|N|7|2Y|8|@$D|2Z|E|30|F|U]|$D|31|E|32|F|U]|$D|33|E|34|F|U]]|9|@]|A|$]]|$1|13|3|-4|5|6|7|35|8|@]|9|@]|A|$]]|$1|14|3|Q|5|R|7|36|8|@]|9|@$D|37|E|38|1|39]]|A|$]]|$1|15|3|X|5|6|7|3A|8|@]|9|@]|A|$]]|$1|16|3|-4|5|6|7|3B|8|@]|9|@]|A|$]]|$1|17|3|18|5|N|7|3C|8|@]|9|@]|A|$]]|$1|19|3|-4|5|6|7|3D|8|@]|9|@]|A|$]]|$1|1A|3|Q|5|R|7|3E|8|@]|9|@$D|3F|E|3G|1|3H]]|A|$]]|$1|1B|3|X|5|6|7|3I|8|@]|9|@]|A|$]]|$1|1C|3|-4|5|6|7|3J|8|@]|9|@]|A|$]]|$1|1D|3|1E|5|N|7|3K|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|N|7|3L|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|6|7|3M|8|@]|9|@]|A|$]]|$1|1J|3|Q|5|R|7|3N|8|@]|9|@$D|3O|E|3P|1|3Q]]|A|$]]|$1|1K|3|X|5|6|7|3R|8|@]|9|@]|A|$]]|$1|1L|3|-4|5|6|7|3S|8|@]|9|@]|A|$]]]|1M|$1N|$5|1O|1P|1Q|A|$1R|1S|1T|-4]]|1U|$5|1O|1P|1Q|A|$1R|1V|1T|-4]]|1W|$5|1O|1P|1Q|A|$1R|1X|1T|-4]]|1Y|$5|1O|1P|1Q|A|$1R|1Z|1T|-4]]|20|$5|1O|1P|1Q|A|$1R|21|1T|-4]]]]

I hate to post my own answer, but some answers recently have ignored the solution I posted in my own question, suggesting approaches that are nothing short of foolhardy.

In short - you do not need to edit any Windows user account privileges at all. Doing so only introduces risk. The process is entirely managed in IIS using inherited privileges.

<h2>Applying Modify/Write Permissions to the Correct User Account</h2>

<ol>
<li>Right-click the domain when it appears under the Sites list, and choose Edit Permissions

<a href="https://i.stack.imgur.com/b237H.png" rel="noreferrer"><img src="https://i.stack.imgur.com/b237H.png" alt="enter image description here"></a>

Under the Security tab, you will see <code>MACHINE_NAME\IIS_IUSRS</code> is listed. This means that IIS automatically has read-only permission on the directory (e.g. to run ASP.Net in the site). You do not need to edit this entry.

<a href="https://i.stack.imgur.com/1Jnl7.png" rel="noreferrer"><img src="https://i.stack.imgur.com/1Jnl7.png" alt="enter image description here"></a></li>
<li>Click the Edit button, then Add...</li>
<li>In the text box, type <code>IIS AppPool\MyApplicationPoolName</code>, substituting <code>MyApplicationPoolName</code> with your domain name or whatever application pool is accessing your site, e.g. <code>IIS AppPool\mydomain.com</code>

<a href="https://i.stack.imgur.com/P4BQe.png" rel="noreferrer"><img src="https://i.stack.imgur.com/P4BQe.png" alt="enter image description here"></a></li>
<li>Press the Check Names button. The text you typed will transform (notice the underline):

<a href="https://i.stack.imgur.com/cZDJK.png" rel="noreferrer"><img src="https://i.stack.imgur.com/cZDJK.png" alt="enter image description here"></a></li>
<li>Press OK to add the user</li>
<li>With the new user (your domain) selected, now you can safely provide any Modify or Write permissions

<a href="https://i.stack.imgur.com/x3TXY.png" rel="noreferrer"><img src="https://i.stack.imgur.com/x3TXY.png" alt="enter image description here"></a></li>
</ol>

blocks|key|3038661|text|仅当您使用ApplicationPool标识时，IIS_IUSRS组才具有显着性。即使您的组在运行时看起来是空的，IIS也会根据microsoft文献添加到该组中以运行辅助进程。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3038662|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

IIS_IUSRS group has prominence only if you are using ApplicationPool Identity. Even though you have this group looks empty at run time IIS adds to this group to run a worker process according to microsoft literature.

I've just moved away from IIS6 on Win2003 to IIS8 on Win2012 for hosting ASP.NET applications.

Within one particular folder in my application I need to Create &amp; Delete files. After copying the files to the new server, I kept seeing the following errors when I tried to delete files:

<blockquote>
 Access to the path 'D:\WebSites\myapp.co.uk\companydata\filename.pdf' is denied.
</blockquote>

When I check IIS I see that the application is running under the DefaultAppPool account, however, I never set up Windows permissions on this folder to include IIS AppPool\DefaultAppPool

Instead, to stop screaming customers I granted the following permissions on the folder:

IUSR

<ul>
<li>Read &amp; Execute</li>
<li>List Folder Contents</li>
<li>Read</li>
<li>Write</li>
</ul>

IIS_IUSRS

<ul>
<li>Modify</li>
<li>Read &amp; Execute</li>
<li>List Folder Contents</li>
<li>Read</li>
<li>Write</li>
</ul>

This seems to have worked, but I am concerned that too many privileges have been set. I've read conflicting information online about whether IUSR is actually needed at all here. Can anyone clarify which users/permissions would suffice to Create and Delete documents on this folder please? Also, is IUSR part of the IIS_IUSRS group?

<h2>Update &amp; Solution</h2>

Please see <a href="https://stackoverflow.com/a/36597241/792888">my answer below</a>. I've had to do this sadly as some recent suggestions were not well thought out, or even safe (IMO).

IIS_IUSRS and IUSR permissions in IIS8

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我刚刚从Win2003上的IIS6迁移到Win2012上的IIS8来托管ASP.NET应用程序。在我的应用程序中的一个特定文件夹中，我需要创建和删除文件。将文件复制到新服务器后，当我尝试删除文件时，我一直看到以下错误：对路径'D:\WebSites\myapp.co.uk\companydata\filename.pd...

问IIS8中的IIS_IUSRS和IUSR权限
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问IIS8中的IIS_IUSRS和IUSR权限EN