IIS 7：标识'IIS APPPOOL \\ DefaultAppPool'没有足够的权限来访问临时目录

Question

I have strange and unresolvable problem with my IIS 7.0 on Windows7.
I try run site on my local test server and get following error:

Access to the temp directory is denied.  
Identity 'IIS APPPOOL\DefaultAppPool' under  
which XmlSerializer is running does not have sufficient permission  
to access the temp directory.  

CodeDom will use the user account the process is using to do the compilation,  
so if the user doesn't have access to system temp directory,  
you will not be able to compile.  
Use Path.GetTempPath() API to find out the temp directory location.

I have several pools, but only one among them works correctly. It's . Running sites on other ones I get error, which was provided earlier. The most intresting is I cann't find any differents between pools' configuration through Application Pools of IIS Manager. Maybe I am missing something?
I tried to change access rights for Windows\\Temp , C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Temporary ASP.NET Files , and local settings' temporary folder , but my actions did not have effects.

So, hope for your help and some advices.

Answer 1

Did you call the Path.GetTempPath() method (you can call this method from every program, not necessary from your website)?

You must set full access to this path for your account.

Also I found this forum topic :

Another reason could be that the processModel in machine.config is set so that ASP.Net is running inside dllhost.exe instead of aspnet_wp.exe. If this is the case then you would need to give rights to IWAM_machineName account as well.

You can check the name of the process and account under with access denied error occurs by using FileMon utility from sysinternals.com.

Answer 2

One other option to consider...the DefaultAppPool creates its own user account and folder under the "c:\\Users" directory when the pool is created and first run. Its actually a virtual user account and should be named for the Application Pool, or "DefaultAppPool". It uses this temporary user account to run the pool. In some setups people are not seeing this folder but a TEMP folder when the IIs web site is accessed and using the Default pool. This User folder is used by the pool and ASP.NET for caching and writing of file resources and other things used by IIs, ASP.NET, and this virtual account.

If you instead see a "TEMP" folder in the Users folder you have a broken application pool account in IIs and in the Registry. The pool is creating the TEMP folder as a backup for this virtual account, which might not have the right security setup. I had this exact scenario.

To fix it go to the registry under: HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList See if you have a SID user account with the ".bak" extension for a DefaultAppPool user account. If so delete it and restart your PC. Test your website again, making sure its actually setup to use DefaultAppPool. It should now recreate the "DefaultAppPool" folder in Users, recreate the registry entry for DefaultAppPool user, and your error should go away. ie no TEMP folder.

After I did this, all my stack overflow errors went away in Visual Studio for my web application and all the restarting and final crash of the Application Pool in IIs.