IIS ApplicationPoolIdentity 没有“临时 ASP.NET 文件”的写权限

Question

I am attempting to launch a website from an 'AppPool' called 'SomeAppPool' which uses the 'ApplicationPoolIdentity' and when I do I receive the following error when I launch the website:

The current identity (IIS_APPPOOL\\SomeAppPool) does not have write access to 'c:\\WINDOWS\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files'

I'm launching the website with 'Use Local IIS Web Server' within Visual Studio 2012 (with no debugger attached) under Windows 8.

The first thing I noticed is that the 'Temporary ASP.NET Files' folder does not even exist so there is nothing to set security permissions on.

The second issue is, even if there was a folder, what permissions would I set? I'm assuming that I should not have to set permissions for each user created through 'ApplicationPoolIdentity'. Right?

The current solutions i've seen simply suggest to set the user to 'Network Service' but this seems to break the isolation of the website for which 'ApplicationPoolIdentity' was introduced.

Answer 1

This ASP.NET forum answer , unacknowledged in its thread, was the solution for me. It's also low-impact: it doesn't try to re-register IIS or give the user dangerous privileges. To summarize the answer:

1. Open a Command window as an administrator (Start / Programs / Accessories, then right-click over Command Prompt, then choose "Run as administrator").

2. Enter the following command:

    C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Aspnet_regiis.exe -ga domain\\user\u003c/code>

Substitute your domain and user for domain\\user\u003c/code> in the example above. That's all it took.

The Microsoft documentation for Aspnet_regiis.exe is here . Note that the documentation for the -ga switch refers to a bug in versions 3.5 and earlier, where it wouldn't work with local accounts. If I'm reading it correctly, domain accounts are supported for all versions and local accounts are supported starting with Framework 4.0.

---

Update 6 June 2017 : For Windows 8 and above, consider the dism command instead. It's covered in this SO answer . Thanks to @codebrain for suggesting this.

---

Update 7 July 2015 : @Vertigo kindly commented that this answer also worked for the NETWORK SERVICE account in .NET 2.0 under 2008R2/2012, so my disclaimer above about local accounts pre-4.0 may be wrong.

If anyone else finds that this works for a local account under .NET 3.5 or earlier, please feel free to edit my answer or to note it in the comments; it would be a great help to others who may experience this same problem.

Answer 2

I faced same problem. I checked the path c:\\WINDOWS\\Microsoft.NET\\Framework\\v4.0.30319\\ looking for Temporary ASP.NET Files , but there was not any folder by this name. so I created a new folder manually and named it Temporary ASP.NET Files and problem fixed.

So ensure the mentioned path exists.

Answer 3

Along with the up voted solutions, Please check your disk space and make sure there is enough disk space available.

I just ran in to this issue on one of our production server and it was related to the low disk space.

Answer 4

我通过将应用程序池使用的用户添加到 IIS_IUSRS 组解决了该错误。

Answer 5

Being in the C:\\WINDOWS\\Microsoft.NET\\Framework\\v4.0.30319 try running the aspnet_regiis.exe command.

Typically the permissions should be set up. If Windows Add/Remove Programs happen, or if new .NET versions get installed, these things get reset a bit. Running the aspnet_regiis.exe should help there.

Also, ensure you're running Visual Studio as an Administrator.

Answer 6

We're 2021 now, but ran into this issue as well on a Windows Server 2019.

The error CS0016 was misleading in my case: Giving permissions for ApplicationPool-Identities or similar users on the Temporary ASP.NET Files didn't work and wasn't the actual issue.

After installing a fresh server, Users does not have permission to modify the temp folder in the C:\\Windows directory . When .NET needs to write temporary files to the temp folder, an exception occurs because of no permission to write.

Assigning modify permissions for Users to the temp folder under the C:\\Windows directory worked for me.

Answer 7

I just ran into this and what I did was to create a new account, lets say its "Webby".

In ISS, go into Advance Settings of your page and change "Physical Path Credentials" to the Webby account. The Path field above that has the webpage directory; open this folder in Explorer and add Webby with Modify permissions. Under "Failed Request Tracing" there's a logs directory; add modify to that too and set "Enabled" to true (you can turn it off later, but make sure it'll work). At this point you can try your site and you should definitely get the error message, because of the user you are using.

The current identity (YOUR\\Webby) does not have write access to 'C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files'.

Now, to fix your problem, you will need to go to the 'C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files' directory and add Webby to that as well, again Modify works.

The solution of using a special account just for websites is a good idea. It is a real account (not virtual like ApplicationPool) and Windows doesn't get confused (...as easily).

Hope this helps.

Answer 8

In IIS7, I right clicked on the virtual directory, removed the application and added it again. That fixed it for me.

Answer 9

我通过释放磁盘空间解决了它

Answer 10

I have had this problem, and I can resolved it. You only have to give permissions to the folder: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files, for your current user. It's easily.

Good luck!!