AppPool running with Domain identity - "service unavailable"

[Kevin C]

I have been trying to move our web apps into their own AppPool so we can run
it under a specific domain account and hit our DB servers. Whenever I
change the identity of the AppPool to "DOMAIN\MyUserAccount" I get the
infamous "Service Unavailable" page with the following event log entries:
-----------------------------------------------
(the events occured in this order - from earliest -> most recent)
Event ID: 1021
Description:
The identity of application pool, 'TestAppPool' is invalid. If it remains
invalid when the first request for the application pool is processed, the
application pool will be disabled. The data field contains the error
number.

Event ID: 1057
Description:
The identity of application pool 'TestAppPool' is invalid, so the World Wide
Web Publishing Service can not create a worker process to serve the
application pool. Therefore, the application pool has been disabled.

Event Type: Error
Event ID: 1059
Description:
A failure was encountered while launching the process serving application
pool 'TestAppPool' . The application pool has been disabled.
-------------------------------------------

I have attempted to do everything stated by other sites but still no
success:

This is what I have configured so far:
1. Added the domain user to the IIS_WPG user group.
2. Set impersonation to false.
3. Set Anonymous to false, enabled WindowsAuth.

The part that bothers me the most is the warning "The identity of
application pool, 'TestAppPool' is invalid ..." The account is valid, but
obviously I am missing something here.

[Kevin C]

Update: If I add that domain account to the "Administrators" group
everything works fine. Obviously I don't intend to run like this but I'm
not sure what elevating the privileges of this account has done to allow it
to start working!


"Kevin C" <kc@noneya.com> wrote in message
news:ud8gRokzEHA.1404@TK2MSFTNGP11.phx.gbl...

> I have been trying to move our web apps into their own AppPool so we can

run

> it under a specific domain account and hit our DB servers. Whenever I
> change the identity of the AppPool to "DOMAIN\MyUserAccount" I get the
> infamous "Service Unavailable" page with the following event log entries:
> -----------------------------------------------
> (the events occured in this order - from earliest -> most recent)
> Event ID: 1021
> Description:
> The identity of application pool, 'TestAppPool' is invalid. If it remains
> invalid when the first request for the application pool is processed, the
> application pool will be disabled. The data field contains the error
> number.
>
> Event ID: 1057
> Description:
> The identity of application pool 'TestAppPool' is invalid, so the World

Wide

> Web Publishing Service can not create a worker process to serve the
> application pool. Therefore, the application pool has been disabled.
>
> Event Type: Error
> Event ID: 1059
> Description:
> A failure was encountered while launching the process serving application
> pool 'TestAppPool' . The application pool has been disabled.
> -------------------------------------------
>
> I have attempted to do everything stated by other sites but still no
> success:
>
> This is what I have configured so far:
> 1. Added the domain user to the IIS_WPG user group.
> 2. Set impersonation to false.
> 3. Set Anonymous to false, enabled WindowsAuth.
>
> The part that bothers me the most is the warning "The identity of
> application pool, 'TestAppPool' is invalid ..." The account is valid, but
> obviously I am missing something here.
>
>
>
>

[Hernan de Lahitte]

This seems to be a security permissions issue with your account.
Try this advice:

How To: Create a Custom Account to Run ASP.NET
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT01.asp?frame=true[/url]

--
Hernan de Lahitte
[url]http://weblogs.asp.net/hernandl[/url]


"Kevin C" <kc@noneya.com> escribió en el mensaje
news:uZ8Y$rkzEHA.3936@TK2MSFTNGP10.phx.gbl...

> Update: If I add that domain account to the "Administrators" group
> everything works fine. Obviously I don't intend to run like this but I'm
> not sure what elevating the privileges of this account has done to allow
> it
> to start working!
>
>
> "Kevin C" <kc@noneya.com> wrote in message
> news:ud8gRokzEHA.1404@TK2MSFTNGP11.phx.gbl...

>> I have been trying to move our web apps into their own AppPool so we can

> run

>> it under a specific domain account and hit our DB servers. Whenever I
>> change the identity of the AppPool to "DOMAIN\MyUserAccount" I get the
>> infamous "Service Unavailable" page with the following event log entries:
>> -----------------------------------------------
>> (the events occured in this order - from earliest -> most recent)
>> Event ID: 1021
>> Description:
>> The identity of application pool, 'TestAppPool' is invalid. If it
>> remains
>> invalid when the first request for the application pool is processed, the
>> application pool will be disabled. The data field contains the error
>> number.
>>
>> Event ID: 1057
>> Description:
>> The identity of application pool 'TestAppPool' is invalid, so the World

> Wide

>> Web Publishing Service can not create a worker process to serve the
>> application pool. Therefore, the application pool has been disabled.
>>
>> Event Type: Error
>> Event ID: 1059
>> Description:
>> A failure was encountered while launching the process serving application
>> pool 'TestAppPool' . The application pool has been disabled.
>> -------------------------------------------
>>
>> I have attempted to do everything stated by other sites but still no
>> success:
>>
>> This is what I have configured so far:
>> 1. Added the domain user to the IIS_WPG user group.
>> 2. Set impersonation to false.
>> 3. Set Anonymous to false, enabled WindowsAuth.
>>
>> The part that bothers me the most is the warning "The identity of
>> application pool, 'TestAppPool' is invalid ..." The account is valid,
>> but
>> obviously I am missing something here.
>>
>>
>>
>>

>
>