IIS Permissions for App Pool Accounts

The following section describes how to configure IIS permissions for Application Pool Accounts.

The Application Pool Accounts used in a K2 installation are:

Setting Application Pool Rights

The K2 Application Pool Identity accounts will require elevated permissions to run the application pool. We will use the aspnet_regiis command to configure this. This tool ships with the .NET Framework, and enables you to easily set all the necessary NTFS permissions, IIS_WPG group membership, security policy user rights assignments, and IIS metabase access rights to allow and ASP.NET Application Pool Identity to work. For more information, see the MSDN article on setting security rights for .NET Applications, at http://msdn2.microsoft.com/en-us/library/ms998297.aspx.

To use the aspnet_regiis command, perform the following steps:

  1. Open a command prompt (Start > Run > cmd).
  2. Change directories to the .NET Framework folder (C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319).
  3. Type aspnet_regiis -ga domain\[Application Pool account] (the application pool user account used for the site) and hit Enter.
  4. After the command completes, type iisreset and hit Enter.

IIS Group Membership

The K2 Web Service Account must be added to the IIS_IUSRS group. To achieve this follow the steps below:

  1. Go to Active Directory Users and Computers.
  2. Select the domain containing the service account.
  3. Click on the Builtin folder and the IIS_IUSRS group will be visible.
  4. Right click on the IIS_IUSRS group, select Properties.
  5. Next click on the Members tab, then the Add button.
  6. Enter the name of the K2 Web Service User account in part or whole into the Add User field.
  7. Click Check Names, to confirm the name or make a selection if there are more than one with similar naming.
  8. Click OK.
  9. Click OK when complete.