Default permissions for the ASPNET account
The ASPNET account is created as a local account when you install ASP.NET. The ASPNET account belongs only to the Users group on that computer. Therefore, the ASPNET account has all of the rights that are associated with the Users group and can access any resources that the Users group is granted access to. The ASPNET account inherits the following user rights from the Users group.
User right Explanation
SeChangeNotifyPrivilege Bypass traverse checking.
SeUndockPrivilege Remove the computer from the docking station.
SeInteractiveLogonRight Log on locally.
SeNetworkLogonRight Access this computer from the network.
In addition to these rights, the ASPNET account is also granted the following rights by default:
User right Explanation
SeServiceLogonRight Log on as a service.
SeBatchLogonRight Log on as a batch job.
SeDenyInteractiveLogonRight Deny log on locally.
ASP.NET grants specific, full-access permissions for the ASPNET account to the following folders:
* Temporary ASP.NET Files
* %windir%\temp
Additionally, ASP.NET grants Read permission to the Microsoft .NET Framework installation directory.
Enabling impersonation
With impersonation, you run in the security context of the request entity, either as an authenticated user or as an anonymous user. In ASP.NET, impersonation is optional and is not enabled by default. To enable impersonation at the level of the computer or the application, add the following configuration directive in the <system.web> section of the Machine.config or the Web.config file:
Code:
<identity impersonate="true"/>
for more details: http://support.microsoft.com/kb/317012
Bookmarks