Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Security
        Changing Worker Process Identity in IIS 6

Section(s): Security , Network
Published on Aug 30, 2005.
Last Modified on Aug 30, 2005.
Last Modified by Mitch Tulloch.
Rated 1.5 out of 5 based on 2 votes.

In IIS 6 on W2K3, all worker processes run by default using NetworkService as their identity.

In IIS 6 on W2K3, all worker processes run by default using NetworkService as their identity. This is done for security reasons since NetworkService is an account that has very few privileges.

If you want however, you can further isolate worker processes by assigning them each their own user account. If you make this change however, you need to make sure you do two things:

Assign the new account a complex password
Make the new account a member of the IIS_WPG built-in group.

The default IWAM_servername account is in fact a member of this group.

About Mitch Tulloch

Mitch Tulloch was lead author for the Windows Vista Resource Kit from Microsoft Press, which is the book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. Mitch was also the author of Introducing Windows Server 2008 and technical project lead for the Microsoft Office Communications Server 2007 Resource Kit, both books also from Microsoft Press. For more information on these and other books by Mitch, see www.mtit.com .