title: IIS AppPool to SQL Server permissions (adding NT AUTHORITY\IUSR)
body: <p>I've got a new server build running Windows Server 2012 R2, IIS 8.5 (inc. ClassicASP feature) and SQL Server 2014 Express.  I want to use Application Pool Identity to connect to the database.  The database is set to "Windows Authentication Mode".</p>
  
  <p>My Application Pool Identity is called <code>activbase.net</code>.  I've set up a Security Login in SQL Server called <code>IIS AppPool\activbase.net</code> and user mapped it my database with <code>db_datareader</code> and <code>db_datawriter</code> access.</p>
  
  <p>However when I try to access the database from the website, I get:</p>
  
  <blockquote>
    <p>Cannot open database "ActivbaseLive" requested by the login. The login failed.</p>
  </blockquote>
  
  <p>I thought this was enough to get the connection working.
  The Application Log (Event Viewer) shows:</p>
  
  <blockquote>
    <p>Login failed for user 'NT AUTHORITY\IUSR'. Reason: Failed to open the explicitly specified database 'ActivbaseLive'. [CLIENT: ]</p>
  </blockquote>
  
  <p>So I have added <code>NT AUTHORITY\IUSR</code> likewise to the SQL Server>Security>Logins and Databases>[ActivbaseLive]>Security>Users and this fixes the problem.</p>
  
  <p>My questions are as follows:</p>
  
  <ol>
  <li>Should I be needing to add <code>NT AUTHORITY\IUSR</code> login/user in addition to <code>IIS AppPool\activbase.net</code> login/user to my SQL Server Instance and database?</li>
  <li>Is there a security issue with doing this? (NOTE: this will be a production environment)</li>
  </ol>
  
  <p>Thanks,
  Chris</p>