Assign User to IIS AppPool via Powershell

Question

I tried this code and it appears to work fine. However, i noticed if you assign the username and password to an account that does not exist the code continues without issue. In addition, if you assign an invalid account and call stop() and then start() the IIS pool indeed stops and starts!! Furthermore, when I go to InetMgr and start,stop or recylce the pool it also stops and starts without complaining!

I was hoping that adding an invalid account would throw an error effectively allowing me to test the validity of an account. Why does it behave this way?

$loginfile = "d:\temp\Logins.csv"
$csv = Import-Csv -path $loginfile
ForEach($line in $csv){

   $poolid = "MyDomain\" + $line.Login;
   Write-Host "Assigning User to Pool:" $poolid;

   $testpool = get-item iis:\apppools\test;
   $testpool.processModel.userName = $poolid;
   $testpool.processModel.password = $line.Pwd;
   $testpool.processModel.identityType = 3;
   $testpool | Set-Item
   $testpool.Stop();
   $testpool.Start();
   Write-Host "IIS Recycled";

   $testpool = get-item iis:\apppools\test;
   write-host "New Pool User: " $testpool.processModel.userName;
   write-host "New Pool PWd: " $testpool.processModel.password;
}

Answer 1

You should always validate your credentials before setting the pool identity. This can be accomplished via the PrincipalContext .NET class -- specifically look at PrincipalContext.ValidateCredentials(user, password).

Sample:

#-- Make sure the proper Assembly is loaded
[System.Reflection.Assembly]::LoadWithPartialName("System.DirectoryServices.AccountManagement") | out-null

#-- Code to check user credentials -- put in function but here are the guts
#-- Recommend you use SecureStrings and convert where needed
$ct = [System.DirectoryServices.AccountManagement.ContextType]::Domain
$pc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList $ct,"domainname"
$isValid = $pc.ValidateCredentials("myuser","mypassword")

If local account change the $ct to 'Machine' ContextType.