可从 IIS 访问的虚拟文件夹，但不能从网页访问

Question

I've been trying for a while to reduce what I'm trying to do to its simplest, working form.

At this point, my setup consists of:

• Clean Windows 10 install.
• Clean IIS 10 install.
• In IIS, I added a Virtual Directory aliased as "dddd" pointing to folder "d:\\myfiles\\" (which is outside the root web folder).
• In IIS, when I right click on "dddd" > Explore: Windows Explorer comes up with my list of files just fine.
• In IIS, however, when I right click on "dddd" > click "Manage Virtual Directory" > Browse > I get "Access is denied".

Not too surprising at this point; probably permissions related. So I start to fiddle with NTFS permissions.

Before I change anything, I notice that this folder has the System account listed with full control, along with MY account also with Full Control (and also MY account as the owner).

I'll start by adding the Network Service account with (default) Permissions as Read & Execute, List Folder Content and Read permissions; however, no luck.

I'll then add the IIS_IUSRS account; with the same default permissions; still getting access denied.

At this point I don't want to go any further because my - surely limited - understanding of such things - tells me this should work.

Shouldn't it?

The why isn't it?

Or we can turn this around the other way and ask: What's the minimum permission(s) needed on a (virtual) folder sitting outside the Root IIS folder so that you can list its content by clicking a link on a practically naked HTML file on a practically clean Windows + IIS install?

Thank you,

Flood

Answer 1

Adding permissions for IIS_IUSRS was correct but not necessary for Network Service , as long as you don't use it as the identity for the application pool.

At this point you have two options to make this work.

1. Adding permissions for iusr to "d:\\myfiles\\"

or

2. Change the Anonymous Authentication Credentials for your site.

In IIS Manager select your site, double-click the Authentication icon and select Anonymous Authentication , on the right side click Edit... and then tick Application Pool Identity .

Now rather than IUSR , the application pool identity account is used to access the files and that account is automatically a member of IIS_IUSRS which already has permissions.

So to summaries, without making this change, both IUSR and IIS_IUSRS need read access.

I usually take IUSR out of the picture and just work with IIS_IUSRS or the actual application pool identities.