IIS 10.0 will not allow an application pool identity to be set to a valid service account on .NET482. How do I fix this?

Timothy Dooling 25

I have a series of production websites that are currently running 4.6 with IIS 10. I can set the application pool identity to an internal service account. I can also set WCF services to that service account.

On my development and test servers, which are running net48 with IIS 10, the IIS will not allow me to set the application pool with the same service account although I can set WCF services to that same account and it works in all other contexts.

I also can't set the application pool to my own Active Directory login, so it's not the service account. In both cases (service and personal AD account), the IIS interface says the password is incorrect.

On the development server, I can modify the applicationHost.config file to paste the information in from an account that works on the same server, but that doesn't work on my test server or any of my laptops running either Windows 10 or 11 with .NET Framework 4.8+ enabled or my test server.

When I do this on the IIS 10 with 4.8, IIS hangs and the application pool is shut down eventually.

I have tried to check the configurations (roles and features) to ensure the configuration of the system matches that of the working production server with net46, but it doesn't seem to be a configuration issue as far as I can identify although I am sure it involves how IIS handles encryption using 4.8 vs 4.6.

The way my applications work, I need to be able to set the application pool identity to a service account.

Has anyone encountered with problem before, and, if so, is there a solution to this problem?

MotoX80 34,431 Reputation points

2024-06-03T15:15:37.69+00:00

What error does the IIS manager display?
Lex Li (Microsoft) 5,662 Reputation points Microsoft Employee

2024-06-04T12:42:29.9066667+00:00

Account logins are controlled by Windows and Active Directory. Thus, you should talk to your domain administrators and learn what’s wrong from them.
Timothy Dooling 25 Reputation points

2024-06-04T15:00:29.0066667+00:00

The IIS displays an incorrect username/password combination.

I have already isolated the problem to IIS.

The AD logins for all other logins works as they are supposed to except when I try to enter the information as the application pool identity.

As I mentioned above, I can enter the username/password combination in a WCF service on the same server without a problem and the services involved run as expected.

The problem is an IIS issue of some sort.
MotoX80 34,431 Reputation points

2024-06-04T15:08:37.6166667+00:00

Check the security eventlog for errors.

Open a command prompt and use runas.exe to launch cmd.exe as that account.

Also add that account to the IIS_IUSRS group.
Timothy Dooling 25 Reputation points

2024-06-04T15:31:52.83+00:00

It launched cmd.exe when I used runas.exe with the username and password without error.

The account has been working under IIS for over 15 years from IIS 7 to the present on the production server.

I don't believe whether it is in the IIS_IUSRS group would be the issue unless there has been a change in IIS under .NET48
MotoX80 34,431 Reputation points

2024-06-04T16:13:01.02+00:00

I would think that .Net would only get involved after IIS launched the worker process as that account. And it should not impact the IIS management console when it comes to defining app pools.

Create a test app pool and set it to .Net 2 or 4.0 or no managed code.

See if you can add the user and start the app pool.
MotoX80 34,431 Reputation points

2024-06-05T11:32:16.8633333+00:00

On the development server, I can modify the applicationHost.config file to paste the information in from an account that works on the same server, but that doesn't work on my test server or any of my laptops

Set the account using the IIS management console, appcmd.exe, or the Powershell web administration cmdlet's.
Sam Wu-MSFT 7,531 Reputation points Microsoft Vendor

2024-06-10T10:09:12.7833333+00:00

@Timothy Dooling

Please check whether the account in your application pool has sufficient permissions.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Sam Wu-MSFT 7,531 Reputation points Microsoft Vendor

2024-06-14T07:40:01.9766667+00:00

@Timothy Dooling Do you still meet this issue? If so, could you please share more detailed information account permissions, I am looking forward to seeing your message.

1 answer

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

IIS 10.0 will not allow an application pool identity to be set to a valid service account on .NET482. How do I fix this?

1 answer

Your answer