Permission problems after migrating from Apache to IIS After migrating from Apache server to IIS (7.5), I have some permission problems in Drupal: modules don't seem to have the permissions to delete (unlink) or create files, not even from/into "sites/default/files" folder.

What really interesting is, that if I create my own test.php with a simple file_put_contents in it, it does create and unlink files without any error messages.



BUT for example from AddThis module I got the following error message:


  unlink(sites/default/files/addthis/addthis_widget.js) [function.unlink]: Permission denied in
  C:\&lt;mydrupalpath&gt;\source\includes\file.inc on line 481.


After that, I right clicked the mentioned file, Properties > Security tab > added Everyone with "Full control" rights. Not surprising, this way unlink was already successful.

BUT after that, I can see this it in the Drupal log:


  "The directory sites/default/files/addthis is not writable, because it
  does not have the correct permissions set"




OK, tried to set the right permissions with icacls with granting "modify" and "write" permission to sites/default/files directory like this:

c:\&lt;mydrupalpath&gt;\source\sites\default\files /t /grant "IIS APPPOOL\MyDrupalAppPool":(OI)(CI)(M,W,RX)


OK, result is "Successfully processed 228 files".
Refreshing Drupal site in browser...
Hmm, didn't work, the same error message again (permission problems)...  

I don't understand... if I query the rights with icacls on "files" OR files\addthis directory, it says my application pool does have "modify" rights:

IIS APPPOOL\MyDrupalAppPool:(OI)(CI)(M)


I do have permission problems with Gallery module too... :(

What should I do not to have permission problems in "files" folder when modules try to delete from/write into it?

Thanks in advance!
From here I got the idea to run the following command on a console ("Determining the account used as IIS anonymous identity"):

%windir%\system32\inetsrv\appcmd.exe list config "MyDrupalAppPool" ^ /section:anonymousAuthentication


The result was the following:

&lt;system.webServer&gt;
  &lt;security&gt;
    &lt;authentication&gt;
      &lt;anonymousAuthentication enabled="true" userName="IUSR" /&gt;
    &lt;/authentication&gt;
  &lt;/security&gt;
&lt;/system.webServer&gt;


And then running the following command seems to have solved the problem of writing to/deleting from the "files" directory:

icacls c:\&lt;mydrupalpath&gt;\sites\default\files /t /grant IUSR:(OI)(CI)(M)


I don't know if it's secure enough... Please leave comments if you think there is any kind of problem with this approach. Thanks.