Adding virtual directory in IIS which points to shared path on another machine without AD

Question

I have machines EXTERNAL and INTERNAL (lets call them EXT and INT). Both machines are not part of AD (no network accounts, only local ones) and both machines have Administrator accounts using different credentials (hence forget about pass-thru).

Now what I did is following

• Created directory C:\shareme on INT
• Shared this directory for all administrator accounts
• Opened explorer on EXT and typed \INT\shareme
• Entered credentials of the INT account (INT\Admin and password), all good, I see contents
• here comes the problem...
• Opened IIS on EXT, clicked Add virtual directory
• alias: remote, physical path: \\INT\shareme, Connect as: Specific user, Username: INT\Admin + password
• Test settings fails, it says Logon failure: unknown user name or bad password
• I can explore in IIS but it's only because I authenticated already in windows explorer
• Accessing http://localhost/remote returns error 500.19

Apparently IIS won't care for network credentials. It whines about unknown user name because it probably checks accounts on local machine instead of authenticating with the remote one.

Changing logonMethod doesn't help (Interactive, ClearText etc) Any ideas?

Solution

The user account that the application pool is running under also needs access to the UNC path. I believe the default in IIS 7 is "NETWORK SERVICE", which won't have access to the remote computer. You'll need to configure the application pool to run as an account that exists on both systems w/ the same credentials.

Comments

[Mike]

Thanks. I quite don't get it. What does apppool has to do with virtual directory which is as per my understanding not an application is it really necessary to create separate users just to share a folder? that's ridiculous.

[Spence]

It's an architectural change in IIS 7, which uses the web.config files sprinkled all over the filesystem versus the old-style central configuration database (the Metabase). Have a look here: support.microsoft.com/kb/934515

[Mike]

Thanks for the reference. I'll mark this as an answer as it does resolves the problem although I must say I disapprove method MS forces me to use (passthru -- meaning, creating duplicate accounts on both machines).

[Dragonsdoom]

Thanks for this information, this solved my issue in 2017 on a pair of Windows Server 2012 R2 VMs.