How to use domain windows user account as app pool identity

Question

I will be using a domain windows account(maintained in Active Directory) as Application pool identity in my web server. So i want the account to be a member of IIS_WPG or IIS_IUSRS group. My question is where to do it? in Active Directory or in the web server itself? If i modify the Active Directory, so that the user is part of IIS_WPG/IIS_IUSRS, should be more than enough? or i should edit local users/group(in web server) to make sure i add the domain user to IIS_WPG or IIS_IUSRS group?

Answer 1

I'm not sure about adding via Active Directory as a blanket fix.

We used this method for IIS 6:

1. Add User to IIS_WPG group: Go to Computer Management on the box hosting the site, Local Users and Groups > Groups, right-click IIS_WPG > Add to Group, then add the windows account, Apply, OK.

2. Then allow account to run as service: Admin Tools > Local Security Policy > Local Policies > User Rights Assignment > Log on as a service Properties, Add user, Apply, OK

3. Set App Pool Identity: IIS > App Pool Properties > Identity tab, set as configurable and input user, Apply, OK.

4. Then reboot box.

Good resource: Steps for setting up a custom identity of an IIS 6 application pool

Answer 2

Right click on your Application Pool, in Process Model section, identity (first one) go in and select the second radio button which is Custom account and enter your desire account and password