Unable to set password in IIS 8 for Domain User as ApplicationPool Identity

As per How do you setup an IIS Web App so it can access a network share without an AD?

I had the same problem but couldn't let the password in clear text so I dig a little further and found this article: Custom IIS App Pool Identity: Value does not fall within the expected range

The key step to diagnose is to look at the right events :

To figure out how to resolve this, I went into the event viewer. There was nothing in the Application log, so I headed down to Applications and Services Logs => Microsoft => Windows => IIS-Configuration. The logs in here are disabled by default, so they have to be enabled. (To do so, right click the log, and choose Enable log.) Once enabled, re-run the attempt to set the identity, and refresh the view (Actions pane or F5), and voila!, now we have some more information on the error. In the results were two Errors (event ID 42 and 43).

I had the same event errors as in the article :

ID 42: Failed to initialize the 'IISWASOnlyAesProvider' encryption provider in '\?\C:\windows\system32\inetsrv\config\applicationHost.config'. Please check your configuration.

ID 43: Failed to encrypt attribute 'Microsoft.ApplicationHost.AesProtectedConfigurationProvider'.

Then I did the following :

• restore an old version of the ConfigEncKey.key file (to c:\windows\System32\inetsrv\config )
• replace the <configProtectedData><providers> section by an old one (in c:\windows\System32\inetsrv\config\applicationHost.config )

Then I can again set a custom identity to the application pool.

You can grab the private key from another server and simply import it in to this server by first exporting a key from another IIS server that works: C:\Windows\Microsoft.NET\Framework64\v4.0.30319>aspnet_regiis -px "iisWasKey" "C:\temp\AESKeys.xml" -pri

Second you can restore that key on the broken machine (copy the key to the other server and put it in the same place): C:\Windows\Microsoft.NET\Framework64\v4.0.30319>aspnet_regiis -pi "iisWasKey" "C:\temp\AESKeys.xml"

Third you edit the c:\windows\system32\inetsrv\applicationhost.config and use the configprotecteddata section from the known working server to use in place of the one already in this file.

It would look like this section:

If all goes well you can then test it out by creating an application pool and then go to advanced settings and run it as DOMAIN\user or some other user that it needs to be.

Tony Trus

Check the bindings for the applications that is configured on this application pool, if they have any incorrect bindings eg. invalid characters, space and so on.

Source

I have also run into this problem in Windows Server 2012.

If you remove the last parameter when using appcmd, the password, you will succeed changing identity type and setting the username.

I did never figure out why I could not set the password so I retorted to editing my applicationHost.config file directly. Unfortunately with the the password is in clear text.

<configuration>
   ...
    <system.applicationHost>
        <applicationPools>
            ...
            <add name="test-pool" managedRuntimeVersion="v4.0">
                <processModel identityType="SpecificUser" 
                  userName="MyAccountName" password="P@ssw0rd" />
            </add>
            ...
        </applicationPools>
        ...
    </system.applicationHost>
    ...
</configuration>

In addition to configuring the app pool to use a specific account I also did the following:

1) Included the account in the IIS_IUSRS group that indirectly gives it Logon as Batch Job rights.

2) Run the following command to grant rights to the user

aspnet_regiis -ga <your_app_pool_user>

See more: How To: Create a Service Account for an ASP.NET 2.0 Application (MSDN)

3) Restarted WAS and IIS to make sure the changes to the accounts group membership takes hold.

C:> net stop was /y
C:> net start w3svc

Try changing /section:applicationPools to /section:system.applicationHost/applicationPools and adding /commit:apphost to the end

appcmd set config /section:system.applicationHost/applicationPools /[name='AppPoolName'].processModel.identityType:SpecificUser /[name='AppPoolName'].processModel.password:P4ssW0rd /commit:apphost