Re: IIS6 Network Service Identity - when needed?

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 02/03/05 

Date: Wed, 2 Feb 2005 21:32:51 -0800

I would think that the developer of the application should hand you the
requirements -- not you retroactively trying to reverse-engineer the
requirements of the application. I say this because even if the complete
checklist exists, you are STILL not guaranteed to get the application to
work. So, such a list is quite useless from a .Net perspective.

This is because an application's permissions is something that a developer
designs into the application -- not you retroactively trying to infer the
design.

In looking at your other thread, the Application Pool reporting 0xFFFFFFFF
as the error code indicates that the worker process failed to load -- likely
.Net failing to start due to some reason -- will have to troubleshoot the
application layer to determine this. Right now, it is the application
failing to start due to a missing (security) dependency.

Bottom line: it is the application's responsibility to declare extra
privileges that it needs... it is never the server's responsibility to tell
you "hey I'm missing this privilege". 

-- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Joe Krings" <krinjp@jea.com> wrote in message
news:%23P5T0QWCFHA.1936@TK2MSFTNGP14.phx.gbl...
Per MS recommendations, attempting to run IIS6 DefaultAppPool with "Network
Service" identity.  For the 1st app I've installed on IIS6, that's resulting
in "Service Unavailable" error (the server is not a domain controller).
Following other docs found on this topic have not resolved the problem.  At
the moment stuck and looking for an analytical work-around.
Now, trying to determine the necessary Identity required (and set up
corresponding app pools) based on the characteristics of the .Net code.
That is, if an app makes use of certain specific calls, I'll know it
can/can't run with the Network Service identity.
This link
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vbcon/html/vbconaccesspermissionsforwebapplications.asp
makes reference to such a call, System.Diagnostics (see article excerpt
under dashed line below).
My question is, does a comprehensive list exist of other calls/usages,
enumerating things like System.Diagnostics, that can be used a checklist to
verify what identity an app is capable of running under - ala "Can this app
run under Network Service pool - yes/no"?
Thanks.  Joe
---------------------------------------------------------
There are some resources that you cannot by default access using the default
user context, because they require access to resources that need
administrative-level privileges. For example, if your application needs to
create a new event log category using methods in the System.Diagnostics
namespace, it cannot do so if it is running in the context of the ASPNET or
NETWORK SERVICE user.

Relevant Pages

  • Re: The curse of constant fields
    ... production branch, EAR construction etc) for a reasonably important J2EE app I am pretty fanatic about sanitizing everything prior to an official build. ... our environment it would be unrealistic. ... Because a lot of time can be wasted if a tester reports that an error is still there, and then it's a question of is the error still there because the build is flawed, or because the developer who "fixed" it only fixed it for a different use case or in his own development environment. ...
    (comp.lang.java.programmer)
  • Re: Are ASP.NET user interfaces essentially dead now?
    ... How does "clickonce" solve the problem up version updates? ... takes longer to develop ASP.NET interface than a windowsform app ... > developer can choose how they want to communicate -- direct to SQL ... using winforms requires that the client has the .NET framework ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Are ASP.NET user interfaces essentially dead now?
    ... proper care and then there is jumping thru hoops, you want to avoid the hoop ... takes longer to develop ASP.NET interface than a windowsform app ... developer can choose how they want to communicate -- direct to SQL servers, ... I see Winforms doing the major amount of interface work and leaving the web ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Versions of .net + visual studio
    ... you do not spend a penny to develop .NET app: ... If you are dedicated/professional .NET developer, ... installtion/coexistence comes in. ... Installing later version of .ENT Framework does not ...
    (microsoft.public.dotnet.framework)
  • Re: VS 2005 questions
    ... >> If you built a .Net Framework 1.1 app for a client, ... you say that a developer might uninstall ... > In order to be able to debug managed code and instantiate managed controls ... > process space and into the main VS app domain. ...
    (microsoft.public.vsnet.general)