http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspxIIS 6.0 introduced a lot of features to increase reliability and security. As an architectural change the worker process w3wp.exe was introduced. To increase security IIS 6.0 by default launched the worker process using the NTAuthority\Network Serviceen-USTelligent Evolution Platform Developer Build (Build: 5.6.50428.7875)http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#10117196Tue, 18 Jan 2011 17:59:34 GMT91d46819-8472-40ad-a661-2c78acb4018c:10117196tc<p>Geee... at first I was scared I&#39;ll have to master icacls.exe since the DefaulAppPool user is not visible in the list when trying to setup filesystem permissions via GUI (security tab). Also this user is not visible in the compmgmt.msc console. However it becomes visible after you assing it (OI)(RX) and possibly any priviledges. Well not the most intuitive solution but at least it works.</p> <p>BTW. I bet most admins in my company just instantly switched to Network Service :)</p> <div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=10117196" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9974755Mon, 08 Mar 2010 14:10:27 GMT91d46819-8472-40ad-a661-2c78acb4018c:9974755Matt Poland<p>So...</p> <p>IIS7 + AppPoolId = W3wp.exe is NETWORK SERVICE</p> <p>IIS7.5 + AppPoolId = W3wp.exe is AppPoolId</p> <p>Does that mean constrained delegation will work with AppPoolId in IIS7 but won't work with AppPoolId in IIS7.5. &nbsp;</p> <p>That means in IIS 7.5 you should use NETWORK SERVICE if you are doing constrained delegation, correct?</p> <div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9974755" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9841089Mon, 20 Jul 2009 10:51:59 GMT91d46819-8472-40ad-a661-2c78acb4018c:9841089Rick Strahl<p>Not sure I understand what you're saying? Use this identity for both anonymous access as well as impersonation? That's gotta be wrong since these two have two very different purposes and security requirements.</p> <p>Also, is this account accessible via the visible Security API at all or does this work just with ICacls?</p> <p>This is lame to say the least - secure or not this makes something that was already difficult to manage even more difficult to configure and maintain and get average users to configure. Not to mention the installation hassles this causes by using totally non-transparent defaults.</p> <div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9841089" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9692421Wed, 03 Jun 2009 22:50:24 GMT91d46819-8472-40ad-a661-2c78acb4018c:9692421Frederic<p>This new feature is available in Vista / win2008 SP2 no need to wait for windows 7, we just tried it on 2008 sp2 and it works like a charm</p> <div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9692421" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9512240Fri, 27 Mar 2009 01:41:11 GMT91d46819-8472-40ad-a661-2c78acb4018c:9512240Microsoft Support Team's IIS Blog<p>IIS 6.0 introduced a lot of features to increase reliability and security. As an architectural change</p> <img src="http://blogs.msdn.com/aggbug.aspx?PostID=9512240" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9473830Sat, 14 Mar 2009 02:30:37 GMT91d46819-8472-40ad-a661-2c78acb4018c:9473830Useful IIS/ASP.NET Information provided by Microsoft Support Teams<p>IIS 6.0 introduced a lot of features to increase reliability and security. As an architectural change</p> <img src="http://blogs.msdn.com/aggbug.aspx?PostID=9473830" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9420192Sat, 14 Feb 2009 01:37:52 GMT91d46819-8472-40ad-a661-2c78acb4018c:9420192Shinva<P>No. Even here it will be domain\machine$</P><div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9420192" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9420058Sat, 14 Feb 2009 00:37:07 GMT91d46819-8472-40ad-a661-2c78acb4018c:9420058Phil Bolduc<p>Does this change how you access external resource, ie SQL Server. With Network Service, we grant access to databases via domain\machinename$. &nbsp;Does this work the same?</p> <div style="clear:both;"></div><img src="http://blogs.msdn.com/aggbug.aspx?PostID=9420058" width="1" height="1">http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx#9419750Fri, 13 Feb 2009 22:38:21 GMT91d46819-8472-40ad-a661-2c78acb4018c:9419750Goodbye Network Service! - Click &amp; Solve<p>PingBack from <a rel="nofollow" target="_new" href="http://www.clickandsolve.com/?p=7757">http://www.clickandsolve.com/?p=7757</a></p> <img src="http://blogs.msdn.com/aggbug.aspx?PostID=9419750" width="1" height="1">