I’m troubleshooting an IIS site where a page needs to read files from a folder outside the site directory. I can open those files from my own Windows account, but the site gets an access denied error.
The app pool is using ApplicationPoolIdentity. I’ve granted permissions to the site’s folder, but not yet to the separate data folder. Is granting access to IIS AppPool\PoolName the right approach, or is there another identity IIS uses when it reads files on a different drive?
If you’ve run into this, I’d also be interested in how you handle permissions when the app pool needs to write files as well as read them.
This usually comes down to which Windows account is opening the file. When you browse a file in Explorer, Windows uses your signed-in account. Your IIS application runs under the application pool’s identity, which may not have the same permissions.
For an application pool using the default
ApplicationPoolIdentity, its local Windows identity is typicallyIIS AppPool\YourPoolName. Grant that identity only the access the app needs on the relevant folder: usually Read for files it serves, or Modify for a specific folder where it must write uploads or logs. Check permissions on parent folders too; the worker process needs to be able to reach the file through the directory tree.If the files are on a network share, check both the share permissions and the NTFS permissions. The pool’s virtual identity may access a remote server as the web server’s computer account; a custom pool identity or configured impersonation changes which account is used.
To narrow it down, confirm the pool’s identity in IIS Manager, then inspect the file and folder security settings for that account. If the permissions look right, use Process Monitor to find the exact path and account involved in the failed access. Also check whether the app is trying to write to a folder that should be read-only, such as its deployed content directory.
Avoid fixing this by granting
Everyoneor broad full control. Give the application pool identity the minimum rights needed on the specific path.