search

opserver / Opserver

Stack Exchange's Monitoring System
https://opserver.github.io/Opserver/
MIT License
4.51k stars 828 forks source link

IIS Permissions #302

Closed HBollah closed 6 years ago

HBollah commented 6 years ago

Hi All,

Wondering if anyone can help. I've setup 3 instances of opserver within Azure and all works fine when I have local admin on the server. I have setup the application pool to run under a service account, which allows connectivity to our SQL servers, but when my local admin is removed, the opserver site doesn't work anymore and says that my login ID doesn't have write access to C:\windows\microsoft.net\framework64\v4.0.30319\temporary ASP.NET files.

It's weird as I set up the website via my account, but everything is running under the service account I specified for. I also cannot log onto the server with the service account, due to our security policies.

Bear in mind I'm not an IIS expert and having to go back quite a few years since I last had a hand in IIS :)

Thanks

NickCraver commented 6 years ago

Which version of windows are you on? Accounts used for application pools need membership in the IIS_IUSRS group, which should have permissions to that folder - can you see if that membership exists?

HBollah commented 6 years ago

Hi Nick,

Appreciate the quick response. Once I get my admin rights back on the server I'll chuck the service account into that group and pray that GPO doesn't remove it from there (believe me, it's annoying, but necessary after a cyber attack back in June).

It is Windows Server 2012 R2 for reference.

Thanks

NickCraver commented 6 years ago

@HBollah any luck here?

HBollah commented 6 years ago

@NickCraver Fingers crossed it seems to be working, but my admin permissions on the server will be revoked on Friday and then I'm on annual leave for 3 weeks :)

NickCraver commented 6 years ago

@HBollah awesome :) Going to close this out to cleanup!