Cannot find "IIS APPPOOL\{application pool name}" user account in Windows Server 2008

Question

I would like to run my custom command with more than one city's id. How to I do that? I didn't find anythind in the documentation. This is source code of my command:

from django.core.management.base import BaseCommand, CommandError
from reservation.models import City

class Command(BaseCommand):
    help = 'Closes the specified poll for voting'

    def add_arguments(self, parser):
        parser.add_argument('city_id', nargs='+', type=int)

    def handle(self, *args, **options):
        for city_id in options['city_id']:
            try:
                city = City.objects.get(pk=city_id)
            except City.DoesNotExist:
                raise CommandError('City "%s" does not exist' % city_id)

            print city

This command works pretty well for python manage.py command_name 1. It prints city with id=1. But I would like to print city with id 1,2.. without executing the same command multiple times. It is python manage.py command_name 1, 2 or python manage.py command_name [1,2,3]. Something like this doesn't work.

Solution 1

This is most likely because IE will use your authenticated credentials rather than the anonymous user account. If your authenticated user doesn't have access then it will fail. One solution is to add your authenticated user to the site's root folder. With IE your credentials that you're using on the network will pass through to the site, but with the other browsers it will ask for a fresh set of credentials.

Your link in the 3rd comment sounds like a good lead. Did you try turning off Negotiate and seeing what happens? Changing the trusted and intranet zones in the 4th link is a good idea too.

btw, In Windows Server 2008 the IIS_IUSRS is taken care of virtually on the fly, so adding IUSRS doesn't hurt anything, but it's not needed either.

Solution 2

I had the same issue in Server 2012 -- for whatever reason it was not creating the virtual accounts (or they were not available for use). -- I believe it's related to the AppHostSvc or the NetMan service not running. -- Ultimately, I took a shotgun approach to fixing it (not recommended, try to do as little as possible for a production environment, but this PowerShell might get you out of a pinch in your dev. environment):

#Requires -Version 4
#Requires -RunAsAdministrator

#######################################

$DebugPreference = "SilentlyContinue";
$VerbosePreference = "SilentlyContinue";
$WarningPreference = "Continue";
$ErrorActionPreference = "Stop";
Set-PSDebug -Strict;
Set-StrictMode -Version 3;

#######################################

Get-WindowsOptionalFeature -Online `
    | where { $_.FeatureName -ilike "*IIS*" -and $_.State -eq "Disabled" } `
    | % { Enable-WindowsOptionalFeature -Online -FeatureName $_.FeatureName -All };

iisreset

Get-Service | ? { $_.ServiceName -eq "W3SVC" } | Start-Service;
Get-Service | ? { $_.ServiceName -eq "W3SVC" } | Set-Service -StartupType Automatic;

Get-Service | ? { $_.ServiceName -eq "WMSvc" } | Start-Service;
Get-Service | ? { $_.ServiceName -eq "WMSVC" } | Set-Service -StartupType Automatic;

Get-Service | ? { $_.ServiceName -eq "AppHostSvc" } | Start-Service;
Get-Service | ? { $_.ServiceName -eq "AppHostSvc" } | Set-Service -StartupType Automatic;

Get-Service | ? { $_.ServiceName -eq "Netman" } | Start-Service;
Get-Service | ? { $_.ServiceName -eq "Netman" } | Set-Service -StartupType Automatic;

iisreset

Solution 3

This short description was caused me to understand and clarify the subject for me.

Application Pool Identity Accounts

Worker processes in IIS 6.0 and in IIS 7 run as Network Service by default. Network Service is a built-in Windows identity. It doesn't require a password and has only user privileges; that is, it is relatively low-privileged. Running as a low-privileged account is a good security practice because then a software bug can't be used by a malicious user to take over the whole system.

However, a problem arose over time as more and more Windows system services started to run as Network Service. This is because services running as Network Service can tamper with other services that run under the same identity. Because IIS worker processes run third-party code by default (Classic ASP, ASP.NET, PHP code), it was time to isolate IIS worker processes from other Windows system services and run IIS worker processes under unique identities. The Windows operating system provides a feature called "virtual accounts" that allows IIS to create a unique identity for each of its application pools. Click here for more information about Virtual Accounts.

Configuring IIS Application Pool Identities

If you are running IIS 7.5 on Windows Server 2008 R2, or a later version of IIS, you don't have to do anything to use the new identity. For every application pool you create, the Identity property of the new application pool is set to ApplicationPoolIdentity by default. The IIS Admin Process (WAS) will create a virtual account with the name of the new application pool and run the application pool's worker processes under this account by default.

To use this virtual account when running IIS 7.0 on Windows Server 2008, you have to change the Identity property of an application pool that you create to ApplicationPoolIdentity. Here is how:

1. Open the IIS Management Console (INETMGR.MSC).
2. Open the Application Pools node underneath the machine node. Select the application pool you want to change to run under an automatically generated application pool identity.
3. Right-click the application pool and select Advanced Settings...

4. Select the Identity list item and click the ellipsis (the button with the three dots).
5. The following dialog appears:

6. Select the Built-in account button, and then select the identity type ApplicationPoolIdentity from the combo box.

To do the same step by using the command-line, you can call the 'appcmd' command-line tool the following way:

%windir%\system32\inetsrv\appcmd.exe set AppPool <your AppPool> -processModel.identityType:ApplicationPoolIdentity

The full document can be read at: Application Pool Identities

Comments

[MacGyver]

making a note of this article: iis.net/learn/manage/configuring-security/…

[MacGyver]

and this: serverfault.com/questions/100516/…

[MacGyver]

forums.iis.net/t/1036880.aspx