---
title: "Why does my IIS app pool get access denied to files I can open?"  
description: "Why does my IIS app pool get access denied to files I can open?"  
author: "Anubhav Sharma"  
published: 2026-10-04  
updated: 2026-10-10  
canonical: https://www.mindstick.com/forum/162238/why-does-my-iis-app-pool-get-access-denied-to-files-i-can-open  
category: "IIS"  
tags: ["iis", "AppPool", "Windows permissions", "Web hosting"]  
reading_time: 2 minutes  

---

# Why does my IIS app pool get access denied to files I can open?

I’m troubleshooting an IIS site where a page needs to read files from a folder outside the site directory. I can open those files from my own Windows account, but the site gets an access denied error.

The app pool is using **ApplicationPoolIdentity**. I’ve granted permissions to the site’s folder, but not yet to the separate data folder. Is granting access to `IIS AppPool\PoolName` the right approach, or is there another identity IIS uses when it reads files on a different drive?

If you’ve run into this, I’d also be interested in how you handle permissions when the app pool needs to write files as well as read them.

## Replies

### Reply by Tilak Mehta

This usually comes down to **which Windows account is opening the file**. When you browse a file in Explorer, Windows uses your signed-in account. Your IIS application runs under the application pool’s identity, which may not have the same permissions.

For an application pool using the default `ApplicationPoolIdentity`, its local Windows identity is typically `IIS AppPool\YourPoolName`. Grant that identity only the access the app needs on the relevant folder: usually **Read** for files it serves, or **Modify** for a specific folder where it must write uploads or logs. Check permissions on parent folders too; the worker process needs to be able to reach the file through the directory tree.

If the files are on a network share, check *both* the share permissions and the NTFS permissions. The pool’s virtual identity may access a remote server as the web server’s computer account; a custom pool identity or configured impersonation changes which account is used.

To narrow it down, confirm the pool’s identity in IIS Manager, then inspect the file and folder security settings for that account. If the permissions look right, use Process Monitor to find the exact path and account involved in the failed access. Also check whether the app is trying to write to a folder that should be read-only, such as its deployed content directory.

Avoid fixing this by granting `Everyone` or broad full control. Give the application pool identity the minimum rights needed on the specific path.


---

Original Source: https://www.mindstick.com/forum/162238/why-does-my-iis-app-pool-get-access-denied-to-files-i-can-open

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.