9

I'm trying to script with PowerShell the act of adding the user IIS AppPool\ASP.NET v4.0 to the Performance Monitor Users group, to be able to use custom performance counters from an ASP.NET application. But, I can't figure out how to address the automatically created ASP.NET user using ADSI.

This works for me:

 $computer = $env:COMPUTERNAME;

 $user = [ADSI]"WinNT://$computer/Administrator,user" 
 $groupToAddTo = "TestGroup"

 $parent = [ADSI]"WinNT://$computer/$groupToAddTo,group" 
 $parent.Add($user.Path)

However, I can't figure out how to find the ASP.NET v4.0 user:

 $computer = $env:COMPUTERNAME;
 # $user = [ADSI]"WinNT://$computer/IIS AppPool/ASP.NET v4.0,user" # <-- Doesn't work

 $groupToAddTo = "TestGroup"

 $parent = [ADSI]"WinNT://$computer/$groupToAddTo,group" 
 $parent.Add($user.Path)

Any clues on how to address that user using ADSI? Or, any other brilliant ways to achieve what I want using Powershell or other command-line tools? GUI works fine, however, automation is the key here.

Erik A. Brandstadmoen
  • 10,430
  • 2
  • 37
  • 55
  • 3
    It isn't powershell, but the following works from a command line: `net localgroup "Performance Monitor Users" "IIS AppPool\ASP.NET v4.0" /ADD` – Artomegus Aug 13 '13 at 14:05
  • Of course! Thanks a lot. I knew this, why didn't I think of it? I would still love to know how to do it with pure ADSI, but this solved my current problem right now. – Erik A. Brandstadmoen Aug 14 '13 at 05:49
  • 1
    Unfortunately "net localgroup" only works if the app pool name is 20 characters or less. I assume this is because the max length of a regular username is 20 chars. If the pool name is longer than that, it will display usage instructions and do nothing. If you try to just provide the first 20 characters of the pool name, it will tel you the user or group does not exist. – Richard Beier Sep 12 '13 at 20:18

1 Answers1

15

The following PowerShell script will add the application pool "ASP.NET v4.0" to the group "Performance Monitor Users"

$group = [ADSI]"WinNT://$Env:ComputerName/Performance Monitor Users,group"
$ntAccount = New-Object System.Security.Principal.NTAccount("IIS APPPOOL\ASP.NET v4.0")
$strSID = $ntAccount.Translate([System.Security.Principal.SecurityIdentifier])
$user = [ADSI]"WinNT://$strSID"
$group.Add($user.Path)

Unlike the net localgroup command, this script will work fine with app pool names longer than 20 characters.

Svein Fidjestøl
  • 3,106
  • 2
  • 24
  • 40