title: How to set up IIS 7 application pool identity correctly?
body: <p>Having deployed my website to IIS7.5 I found one strange behaviour: when application pool identity is left to be <code>ApplicationPoolIdentity</code> by default (as recommended in <a href="http://www.iis.net/learn/manage/configuring-security/application-pool-identities" rel="nofollow noreferrer">IIS Application Pool Identities</a>), <strong><code>Ninject</code></strong> seems to be ignored, as I get the following error, while creating the very first controller:</p>
  
  <blockquote>
    <p>System.InvalidOperationException: An error occurred when trying to
    create a controller of type
    '..MainController'. Make sure
    that the controller has a parameterless public constructor. --->
    System.DirectoryServices.DirectoryServicesCOMException: An operations
    error occurred.</p>
  </blockquote>
  
  <p>I tried to grant <code>FullAccess</code> to <code>IIS AppPool\&lt;MySiteAppPool&gt;</code> to the folder, containing the site (including all subfolders and files), but this did not change anything.</p>
  
  <p>However, when I set the application pool identity to any domain account (even a simple one, without administrative privilages, as well as without any access to the folder with the site), it works normally.</p>
  
  <p>Ninject is installed according to <a href="https://github.com/ninject/ninject.web.mvc/wiki/Setting-up-an-MVC3-application" rel="nofollow noreferrer">Setting up an MVC3 application</a> tutorial through the NuGet package.</p>
  
  <p>I am not sure, if it's relevant, the site is supposed to work in a domain intranet with windows authentication.</p>
  
  <p>So, the only problem seems to be with the application pool identity. As far as I am eager to use the recommended way, I'd love to have the <code>ApplicationPoolIdentity</code>, not a domain account.</p>
  
  <p>What can this be connected with? Is it possible to mix all these together?</p>
  
  <hr>
  
  <p>Here is an SO thread with a similar issue: <a href="https://stackoverflow.com/questions/12311479/asp-net-mvc-4-ninject-mvc-3-no-parameterless-constructor-defined-for-this-ob">ASP.NET MVC 4 + Ninject MVC 3 = No parameterless constructor defined for this object</a>. However no suitable answer there at all either.</p>
  
  <hr>
  
  <p>As a deleted comment suggested, I tried using <code>NetworkSerive</code> as the identity. And it worked properly. However, I guess this is not much better, than a non-privileged domain account.</p>
  
  <hr>
  
  <p><strong>EDIT</strong></p>
  
  <p>Suddenly found another dependency: the application pool identity is used for the windows authentication on sql server, though I expected the client-side user's credentials to be used there.</p>
  
  <p><strong>Based on comments</strong></p>
  
  <p>Agree that a remote sql server can be accessed with the authenticated credentials via impersonation.</p>
  
  <hr>
  
  <p>However it is still not clear what the problem is with ApplicationPoolIdentity and Ninject.</p>
  
  <p>The article mentiond at the very top of this question made me suppose that this could be caused by the fact, that virtual account <em>has no user profile</em>. This aspect remains unclear to me, as one can still enable IIS to load the user profile with the <code>LoadUserProfile</code> attribute. I can't get, what is IIS going to load, if there is no profile for the virtual account?</p>
  
  <p>It is said there:</p>
  
  <blockquote>
    <p>IIS doesn't load the Windows user profile, but certain applications
    might take advantage of it anyway to store temporary data. SQL Express
    is an example of an application that does this. However, a user
    profile has to be created to store temporary data in either the
    profile directory or in the registry hive. The user profile for the
    NETWORKSERVICE account was created by the system and was always
    available. However, with the switch to unique Application Pool
    identities, no user profile is created by the system. Only the
    standard Application Pools (DefaultAppPool and Classic .NET AppPool)
    have user profiles on disk. No user profile is created if the
    Administrator creates a new Application Pool.</p>
    
    <p>However, if you want, you can configure IIS Application Pools to load
    the user profile by setting the "LoadUserProfile" attribute to "true".</p>
  </blockquote>
  
  <hr>
  
  <p>I found the following thread on serverfault.com:</p>
  
  <p><a href="https://serverfault.com/questions/510016/how-can-i-assign-active-directory-permission-to-the-default-app-pool-identity">How can I assign active directory permission to the default app pool identity</a></p>
  
  <p>There it is also stated that app pool identity is unable to work as a network service, in particular, query the AD.</p>