how to setup write permission on App_data in IIS 7? - asp.net

Question

I need to setup a site to work with a local IIS 7 server (running windows 7). And I get a permissions error stating that I should setup write permission on the App_Data folder.
Where do I do this? Do I do this through IIS 7 management, or windows explorer?
url I used for default asp.net website project:
http://localhost:10000/Account/Register.aspx?ReturnUrl=
Server Error in '/' Application.
User does not have permission to perform this action.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Data.SqlClient.SqlException: User does not have permission to perform this action.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[SqlException (0x80131904): User does not have permission to perform this action.]
System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +6277312
System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning() +412
System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +1363
System.Data.SqlClient.SqlInternalConnectionTds.CompleteLogin(Boolean enlistOK) +53
System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(ServerInfo serverInfo, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, TimeoutTimer timeout) +6292062
System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, TimeoutTimer timeout, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance) +6291977
System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance) +352
System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection) +506
System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) +49
System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) +6293782
System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) +78
System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) +1922
System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +89
System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +6296606
System.Data.SqlClient.SqlConnection.Open() +300
System.Web.DataAccess.SqlConnectionHolder.Open(HttpContext context, Boolean revertImpersonate) +150
System.Web.DataAccess.SqlConnectionHelper.GetConnection(String connectionString, Boolean revertImpersonation) +4603263
System.Web.Security.SqlMembershipProvider.CreateUser(String username, String password, String email, String passwordQuestion, String passwordAnswer, Boolean isApproved, Object providerUserKey, MembershipCreateStatus& status) +2858
System.Web.UI.WebControls.CreateUserWizard.AttemptCreateUser() +412
System.Web.UI.WebControls.CreateUserWizard.OnNextButtonClick(WizardNavigationEventArgs e) +226
System.Web.UI.WebControls.Wizard.OnBubbleEvent(Object source, EventArgs e) +586
System.Web.UI.Control.RaiseBubbleEvent(Object source, EventArgs args) +52
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3691

Answer 1

Another possible answer for IIS 7.5+ (Windows Server 2008) is to allow write by the group "IIS_IUSRS". I believe this group even incorporates the IIS 8+ AppPool users, so its a much more durable way to ensure write access to App_Data
C:\inetpub\wwwroot> icacls App_Data /grant IIS_IUSRS:M
processed file: App_Data
Successfully processed 1 files; Failed processing 0 files
C:\inetpub\wwwroot>

Answer 2

I had to setup the site to use application pass-through, and then change the application pool to use NetworkService.

Answer 3

If your application pool uses ApplicationPoolIdentity which is recommended and default you need to grant permissions to IIS AppPool\YourAppPoolName.
See also
https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities
Note that the ApplicationPoolIdentity is a virtual, local account for each application pool which is not part of the SAM database. So some applications refuse to select this accounts.
Note also that old, discontinued IIS releases did not provide the ApplicationPoolIdentity feature.