Professional Microsoft IIS 8

Understanding IIS 8.0 User Accounts

User accounts are greatly simplified in IIS 8.0. The Anonymous User account (previously IUSR_<machinename> in IIS 6.0 and earlier) is now a well-known SID called IUSR. This means that this account has the same name and the same SID on all IIS 8.0 machines. Additionally, accounts such as IWAM_<machinename> and aspnet_wp.exe that you might be familiar with from previous versions of IIS are no longer used.

Lastly, the IIS_WPG group introduced with IIS 6.0 has been replaced with the IIS_IUSRS group from IIS 7.0 onwards. In IIS 6.0, accounts that would be used as web application pool identities needed to be placed into the IIS_WPG group by an administrator. In IIS 8.0, by default, any account configured as a web application pool identity is automatically and dynamically added to the IIS_IUSRS group, if required.

Note

You can disable this behavior and stop an application identity from being automatically added to the IIS_IUSRS group by editing the configuration for that application pool, as follows:

<applicationPools>
   <add name="DefaultAppPool">
      <processModel manualGroupMembership="true" />
   </add>
</applicationPools >

The following table summarizes the user and logon rights granted to the accounts natively used by IIS 8.0. The IUSR account is not specifically listed, as it has no rights specifically assigned to it. Instead, it inherits rights from the default Users group.

The LocalSystem account is used to run IIS 8.0 services, and is ...