You can grant the IIS application-pool identity the file-system access that MDrivenServer and Turnkey need when they run as IIS applications.
When an application runs in IIS, it accesses files as its application-pool identity, not as the interactive Windows user who installed it. For an application pool named MDrivenServerAppPool, that identity is:
IIS APPPOOL\MDrivenServerAppPool
Grant the identity access separately for each application. For example, if MDrivenServer uses MDrivenServerAppPool and Turnkey uses MDrivenTurnkeyAppPool, grant each identity permissions only to its own application folder.
When you need these permissions
Set these permissions when deploying MDrivenServer or Turnkey to IIS. The applications need to write application data and logs. They also need to create directories and distribute assemblies when CodeDress is in use.
The IIS deployment guidance uses separate application pools for MDrivenServer and Turnkey. This provides isolation: a Turnkey application-pool identity does not need access to the MDrivenServer application folder, and vice versa. For the complete IIS deployment procedure, see Documentation:Deploying MDriven Server & Turnkey Core on IIS.
Grant access to an application folder
Use the application-pool identity, not a named administrator account.
- In IIS Manager, identify the application pool assigned to the MDrivenServer or Turnkey site. For example:
MDrivenTurnkeyAppPool. - In File Explorer, open the application's physical folder. For example:
C:\inetpub\wwwroot\MDrivenTurnkey. - Right-click the folder and select Properties, then open the Security tab.
- Select Edit, then Add.
- Enter the application-pool identity in this form:
IIS APPPOOL\<app pool name>. For example:IIS APPPOOL\MDrivenTurnkeyAppPool. - Select Check Names. Windows should resolve the identity. Select OK.
- Grant the required permission, as described in the next section, and apply the change.
- Repeat the procedure for the other application if MDrivenServer and Turnkey use separate application pools.
If the application cannot create required files or directories, grant Full control to the application-pool identity on the application root as the initial deployment setting. This includes the ability to create directories.
Choose a permission scope
| Location or use | Required access | Reason |
|---|---|---|
| Application root | Full control during installation and initial configuration; this is the recommended way to rule out file-access issues. | The application may need to create directories and distribute files within its application area. |
| AppData | Full control during application installation and model upload. After installation and upload, you may reduce read/write access if your deployment requirements allow it. | Application data is created and updated during these operations. |
| Logs | Read and write access. | MDrivenServer and Turnkey write application logs here. The IIS deployment guidance identifies logs under each application's site folder as a log location.
|
| ModeCodeAssemblies | Access is needed when using CodeDress. | CodeDress assemblies must be copied and distributed. |
Windows temporary folder (%temp%)
|
Access for the application-pool user. | The application uses this location when extracting AssetsTK and CodeDress assemblies from a model file. |
The folder list above applies to both MDrivenServer and Turnkey. If you use CodeDress, do not omit the assembly-related access: missing permission can prevent the required assemblies from being copied.
Full control versus reduced access
Granting Full control on the application root is the direct deployment option. It avoids failures caused by a missing create, modify, or copy permission.
If your security policy requires narrower permissions, begin with Full control during installation and model upload, verify that the application runs, and then reduce access only where you have confirmed it is no longer needed. Keep write access for logs and retain the access required for CodeDress when it is used.
For example, after deploying a Turnkey site in C:\inetpub\wwwroot\MDrivenTurnkey, you can initially grant IIS APPPOOL\MDrivenTurnkeyAppPool Full control on that folder. After installation and model upload, retain the permissions needed for the application's data, logs, and any CodeDress assemblies rather than removing write access without testing the running application.
Verify and troubleshoot access
If MDrivenServer or Turnkey does not start, cannot write logs, or fails while copying CodeDress assemblies:
- Confirm that the IIS site uses the application pool whose identity you added.
- Confirm that the identity name is exactly
IIS APPPOOL\<app pool name>and that Check Names resolved it when you added it. - Confirm that the permission applies to the application's physical folder and to the required subfolders.
- Check the application logs in the application's
logsfolder. See Documentation:MDrivenServer log for MDrivenServer logging information. - During startup diagnosis, grant Full control on the application root to the application-pool identity to determine whether the failure is caused by file access. Then apply the reduced-access approach only after the site works.
- For IIS startup diagnostics beyond file permissions, see HowTos:Troubleshooting IIS application startup issues.
MDrivenServer can also try to write exceptions to the Windows Event Log. File-system permission does not grant Event Log permission; configure that separately when the logs report that Event Log access is denied. See Documentation:Eventlog.
Security notes
- Use separate application pools for MDrivenServer and Turnkey when you want file-system isolation between the two applications.
- Do not treat the IIS application-pool account as the logged-in application user. For server-side behavior, the Windows identity is the server account; application-user information follows the current user pattern described for MDriven.
- Store sensitive connection values outside application files when appropriate. Documentation:SecureStoreAndEnvironmentVariables describes using environment variables and secure stores for supported settings.