Access is denied at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo)

c# asp.net iis-7 permissions

23,693

Solution 1

I doubt you can give permissions to execute programs to the standard ASPNET user (and it would be bad practice as well). A better option (short of not starting a process) would be to change the user of the Application Pool to a local user on the server that has permissions to execute the process (preferable a non-admin account). Be aware that the process you start can't have any UI components since you won't see it running.

Solution 2

you can also get this error if you attempt to start a Directory, rather than a File.

23,693

Author by

coder

Updated on March 25, 2021

Comments

coder about 3 years

I am trying to upload files and convert them to another format before saving them on my web server, but I get the following error: System.ComponentModel.Win32Exception (0x80004005): Access is denied at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo) at System.Diagnostics.Process.Start()

There was no problem when I tried to do this on my local machine's web server (Windows 7), but I am getting this error after deploying my website to my web hosting provider, which has Windows Server 2008 R2.

I am using ASP.NET c#. I'm guessing it's a permissions issue, but I'm not sure how to elevate any permissions. Please help!
coder almost 13 years

Thx for the quick reply! can you please tell me how I would go about doing this? I don't see any option that would allow me to change a user for the Application Pool on IIS7.
Haukman almost 13 years

Sure, technet.microsoft.com/en-us/library/cc771170%28WS.10%29.aspx describes it, it's called App Pool Identity
coder almost 13 years

Thanks Haukman, that worked! When I change the user to LocalSystem or LocalService the file is saved successfully. I'm just not sure what this means in terms of the website security and whether I should use LocalSystem or LocalService. Any advice?
Haukman almost 13 years

It's best to have a dedicate user for this, not use LocalSystem or LocalService as those accounts have a lot of access. Best of course is to not spawn any processes from your web site at all. :)
coder almost 13 years

Haukman, I changed the identity to ApplicationPoolIdentity but that doesn't work. I get the following error: "Cannot read configuration file due to insufficient permissions". This is what you were referring to when you said to have a dedicated user right? I don't know what I'm missing here. Should I set permissions for 'httpdocs' from Windows Explorer? Thanks for your help!
Haukman almost 13 years

I meant you create a normal user (next to Administrator, Guest, etc) and use that. The ApplicationPoolIdentity doesn't have much permissions at all. As a test you can create a new user in Windows, make it part of the Administrators group and try to use that. When you have that working you can remove it from the Administrators group and then go through the different permissions in Windows to determine the bare minimums that will make your site work (this part is tricky).