0

I've SQL Server 2012, IIS, ASP.NET Core installed on Windows 7 and Windows 8.1. But in SQL Server when I try to add BUILTIN\IIS_IUSRS as a login, I always get the error shown in image 2. The domain name is the name of the computer itself and the computers are not in any other domain:

enter image description here

Error:

enter image description here

nam
  • 21,967
  • 37
  • 158
  • 332
  • IIS_USRS is a user group. Surely if you were going to do this for some reason, you'd be adding IUSR instead, right? Since it would be the user logging into SQL, not the user group. – ZLK Jul 17 '17 at 00:43
  • 1
    Like the other comment indicated, IIS_IUSRS is a group of all application pool identities. It would be a security risk to use that group in any access control (like SQL Server access), so stop right now and add individual application pool identities you really want to grant instead. – Lex Li Jul 17 '17 at 02:17
  • @ZLK My ASP.NET CORE app created from [this example](https://learn.microsoft.com/en-us/ef/core/get-started/aspnetcore/new-db) but connecting to `SQLEXPRESS2012` instead of `LocalDb` does not work when deployed to `IIS` and adding `IUSR` to the db with db_owner. It works fine when browsing pages that do not call Db. But fails when connecting to Db. But the connection string is not an issue since the app works fine with same connection string when running from `VS2017` – nam Jul 17 '17 at 02:53
  • @LexLi I added `IUSR` with `db_owner` role to my Db. But that does not work as I posted [here](https://stackoverflow.com/q/45135749/1232087) – nam Jul 17 '17 at 15:08
  • I never say you should set permissions on IUSR, do I? A well designed web app should use a service account (Microsoft AD has typical service account setup scenarios you can refer to) as pool identity and then that identity should be granted necessary permissions on the database resources. Follow that route please. IUSR is the built-in anonymous account, and its usage should be minimized (and should not be used if you don't need it at all). – Lex Li Jul 17 '17 at 15:16
  • @LexLi You're correct; you did not ask for using IUSR. What would you advise to solve the db connection issue described [here](https://stackoverflow.com/q/45135749/1232087)? My computer is not in MS AD or in a domain. – nam Jul 17 '17 at 15:22

1 Answers1

0

For anyone having this problem now, note that the BUILTIN\ part is not needed when entering the object name IIS_IUSRS. Including it produces the error that the OP encountered.

Also ensure that the search parameters are set correctly. IIS_IUSRS is a local machine group, so by default it may not be found until the location and object type parameters are tweaked. More info here.

Tawab Wakil
  • 1,737
  • 18
  • 33