Registry access error when Migrating ASP.NET application to IIS7

Question

I'm running windows 7 64-bit and iis7. I'm trying to setup a web application that was previously in iis6 on XP. It's giving me the error below. I've added the network service user to the Performance Monitor Users group to no avail.

Access to the registry key 'Global' is denied. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.UnauthorizedAccessException: Access to the registry key 'Global' is denied.

ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6) that is used if the application is not impersonating. If the application is impersonating via , the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.

To grant ASP.NET access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.

Solution 1

The problem is that user in Windows is known as DefaultAppPool. However he doesn't show up anywhere in the security dialogs. He is an actual user though. My problem was I needed that user to be part of the PerformanceMonitorUsers group because my web service was using PerformanceCounters. Turns out you have to do it from the command line.

net localgroup "Performance Monitor Users" DefaultAppPool /add

Occasionally that does not work and it will give you the error: "There is no such user or group: DefaultAppPool"

To add the user a different way:

1. Go to the Start menu in Windows 7.
2. Type "Edit Users" in the search box.
3. Open "Edit Local Users and Groups".
4. Go to the groups folder.
5. Right-click on the "Performance Monitor Users" group and go to properties.
6. Click the Add... button.
7. Type in "IIS APPPool\DefaultAppPool" and click Check Names.
8. Click OK and you should be good to go.

Solution 2

Use net localgroup "Performance Monitor Users" "IIS AppPool\DefaultAppPool" /add

Solution 3

I had the same issue and I made the same setting as discussed above but it didn't work for me. The changes which worked is

1. Go to IIS (inetmgr.exe).
2. Check your application AppPool advanced settings.
3. Managed PipeLine mode should be Integrated.
4. Process model identity should be Network Service.

This worked in my case. May be this will help you if above setting is not working.

Solution 4

My thanks to Fande455

I had this issue after migrating my web Apps. I do indeed reference performance counters in my app and sure enough I suffered this problem. To me this was a normal issue and on IIS6, and IIS7 on windows 7 adding the usual IIS users to the Performance Monitor Users group solves the problem. However on Windows server 2008 running IIS7 this was not the case and this post did indeed save the day.

Many thanks, I updated my original post Here

View more solutions

Comments

[Ben Anderson]

My App Pool is using the "ApplicationPoolIdentity" user. The web service is trying to access the "Global" key in the registry. But that user does not have access to the registry. I'm trying to figure out how to give that user access? Or even just figure out what that user is?

[Pavel Savara]

Note that your application may not use DefaultAppPool, but for example "ASP.NET v4.0", also note that windows restart may be necessary.

[Chris O]

If the new config setting doesn't kick in right away, then running iisreset might help.

[rocketdoctor]

This worked great, I wasn't aware that my application was using any PerformanceCounters, but I was desperate tried the fix restarted IIS and it worked!

[MultiMat]

I think the group may be IIS_IUSRS from 2016 onwards (at least)