title: Programmatically assigning IIS Application Pool Identity "users" to Groups
body: <p><strong>The Problem:</strong> When new IIS Application Pools are created and set to use the Application Pool Identity for permissions, I am unsure how to add those identities to User Groups such as Administrator or Performance Counter Users.</p>
  
  <p><strong>The Background:</strong> I'm currently writing a C#.NET library which uses Microsoft.Web.Administration in order to do the following:</p>
  
  <ul>
  <li>Detect if IIS 7.x is installed, and if so, what components.</li>
  <li>Install or upgrade IIS 7.x to a provided list of required components.</li>
  <li>Create/manage one or more web sites through IIS.</li>
  <li>Automatically create/manage one application pool per web site</li>
  </ul>
  
  <p>The context is that this library is to be used by executable installers to provide automated deployment of a web server and web sites/services on Windows Server OSes as part of a larger software deployment. So far, all of the above has been implemented, tested, and is (mostly) functional except for the automation of some permissions that need to be performed on Application Pool / Website creation.</p>
  
  <p>In my method for installing a new website, I create a new Application Pool and force it to use the Application Pool Identity:</p>
  
  <pre><code>static public void InstallSite(string name, string path, int port)
  {
      Site site;
      var appPoolName = ApplicationPoolBaseName + name;
  
      using (var iisManager = new ServerManager())
      {
          // Set up a custom application pool for any site we run.
          if (!iisManager.ApplicationPools.Any(pool =&gt; pool.Name.Equals(appPoolName)))
          {
              iisManager.ApplicationPools.Add(appPoolName);
              iisManager.ApplicationPools[appPoolName].ManagedRuntimeVersion = "v4.0";
          }
          iisManager.CommitChanges();
      }
  
      // ... other code here ('site' gets initialized) ...
  
      using (var iisManager = new ServerManager())
      {
          // Set anonymous auth appropriately
          var config = iisManager.GetWebConfiguration(site.Name);
          var auth = config.GetSection("system.web/authentication");
          auth.SetMetadata("mode", "Windows");
          var authSection = config.GetSection("system.webServer/security/authentication/anonymousAuthentication");
          authSection.SetAttributeValue("enabled", true);
          authSection.SetAttributeValue("userName", string.Empty); // Forces the use of the Pool's Identity.
          authSection = config.GetSection("system.webServer/security/authentication/basicAuthentication");
          authSection.SetAttributeValue("enabled", false);
          authSection = config.GetSection("system.webServer/security/authentication/digestAuthentication");
          authSection.SetAttributeValue("enabled", false);
          authSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication");
          authSection.SetAttributeValue("enabled", false);
  
          iisManager.CommitChanges();
      }
  
      // ... other code here ...
  }
  </code></pre>
  
  <p>As I understand it, this would be the best security practice, and I would then add permissions to specific web sites for anything more than minimal system access. Part of this process would be to add these Application Pool identities to User Groups, such as Administrator or Performance Monitor Users. This is where complications arise.</p>
  
  <p>Now, as <a href="http://forums.iis.net/t/1156692.aspx" rel="nofollow noreferrer">documented elsewhere</a>, each Application Pool Identity exists in the format of <code>IIS AppPool\\&lt;pool_name&gt;</code> but this faux-user is not listed through the normal GUI user management controls, and does not seem to be accessible through libraries such as <code>System.DirectoryServices.AccountManagement</code> when following <a href="https://stackoverflow.com/questions/12843469/adding-local-user-to-local-admin-group">this example on SO</a>. Also, other questions about the Application Pool Identity seem to relate to <a href="https://stackoverflow.com/questions/10101162/get-the-application-pool-identity-programmatically">referencing it from within a child website</a>, not from within an installation context.</p>
  
  <p>So, does anyone know what the proper methods are for</p>
  
  <ul>
  <li>a) Referencing and accessing Application Pool Identities programmatically.</li>
  <li>b) Giving Application Pool Identities permissions by adding them User Groups.</li>
  </ul>