How should I set up SQL Server Login permissions for access to website on a different server using Windows Authentication I know this question doesn't really belong here, but I posted on the MS IIS Site and am still hoping for a reply. I have an intranet site created with .NET Framework 4.0 in Visual Studio 2012 and I used the VS2012 publish command with "Window Authentication". The SQL Server is on a different server than the Web Server. I have set up and given the correct permissions to the Application pool for both the NTFS and SQL Server (remember my SQL Server is on a different (virtual) Server. I used this document to set up the particulars:

IIS Setup Win2008R2 Server With IIS 7.0

I also added the machine name (Domain\MachineName$) as a user to the SQL Server, as I couldn't find a way to add the app pool as a user to a SQL Server that wasn't on the same box. Bonus Question -- Is there a way to get the app pool from one server recognized on a different server... it actually came up in intellisense in SQL Server Management Studio, but I wasn't able to add it?

Everything works for "My" login (which is a member of the "administrator" group), but I was unable to allow users to get access to the intranet website unless I added their username to the root folder of the website and gave them permissions.

My Questions:  (Bearing in mind that this is an intranet app that will only be accessed by authenticated users)

1)  Is it OK from a security standpoint to grant users access to the root of the website? If not ... what am I missing... If this is a no-go from a security standpoint, what are the better ways to do this? If it is OK, what permissions do they need?

Bonus Question:

2) Is there a way to get the app pool from one server recognized on a different server?
In order to get the application pool account to be recognized by the SQL Server you'll have to configure the application pool to run under a domain account.  Then give this account the rights that it needs within the SQL Server instance.

If you are using Windows auth then your users will need read access to the folder which is hosting the website, otherwise they won't be able to read the files for the website.  This is normal. Just give the users of the website read only rights to the folder which hosts the website.