Add writing permission to PHP on IIS 7

Question

I need a PHP script to have writing permission in a directory. PHP 5.3 is running as FastCGI under IIS 7 with windows server 2008 as OP. On my php error logs, I got "permission denied" when the script attempts to write a file.

How can I sort this out? I tried to give all right to IIS_IUSR and to IUSR_myservername (with a right click on my folder) but it didn't work.

Any help would be very appreciate,

Regards,

Julien

score 76 · Accepted Answer · edited Nov 20 '18 at 21:19

76

I have the same setup and I have to give write permission to:

IUSR
IIS AppPool\<<AppPoolName>>

edited Nov 20 '18 at 21:19

Kevin Robatel

8,025
3
44
57

answered May 04 '11 at 17:26

tomfumb

3,669
3
34
50

11

Thank you very much, it works when I give writing permission to IUSR! – JuCachalot May 04 '11 at 17:40
1

You also need to do an `iisreset` for php to reload. – svandragt Nov 02 '12 at 16:30
2

@svandragt because if your application runs with 'application pool identity' this is the account it uses – tomfumb Jan 06 '14 at 17:05
1

In My case there was no need to do iisreset, only giving write permission to IUSR done the trick. – Parijat Jul 26 '15 at 09:49
1

<> could be DefaultAppPool – dotnetrocks Mar 28 '19 at 12:52

score 36 · Answer 2 · answered Aug 16 '15 at 10:12

Actually, it's a little bit more complicated.

The first thing to do is to create a simple PHP file on the concerned website. (It's important to create the file on the concerned website because each website can have a different setting.) The content of this file should be:

<?php var_dump(ini_get('fastcgi.impersonate')); ?>

Navigate to this file using a browser.

** Case 1 **

If your browser shows :

string(1) "1"

Then, you need to execute the following command (you need to replace "Default Web Site" by the name you gave to your website in IIS) :

%windir%\system32\inetsrv\appcmd.exe list config "Default Web Site" ^
/section:anonymousAuthentication

You will receive an answer which looks like this :

<system.webServer>
  <security>
    <authentication>
      <anonymousAuthentication enabled="true" userName="IUSR" />
    </authentication>
   </security>
</system.webServer>

The information you are looking for is the value of the username attribute of the anonymousAutthentification tag.

If this value is not empty, its content is the name of the user you need to give write permissions to.
If this value is empty or if the attribute is simply missing, you need to give write permissions to IIS AppPool\AppPoolName (replace "AppPoolName" with the name of your website's application pool).

** Case 2 **

If your browser shows :

string(1) "0"

You need to give write permissions to IIS AppPool\AppPoolName (replace "AppPoolName" with the name of your website's application pool).

Thank you so much for the detail. I'm always a bit antsy when an answer is just "x" without saying how to find out, or why it's "x" — Stephen R, Feb 09 '17 at 16:51
Where to execute the command? In cmd or in some specific shell? — Lahar Shah, Feb 23 '17 at 18:14
@tristan Charbonnier Sorry to bump an old thread but do you know how to do the app pool permissions for AD and network drives? — Craig B, Feb 26 '17 at 22:55
This needs more upvotes! ...after 4 days of search related to "Missing a temporary folder." issue in WordPress, I finally understood that its the IIS AppPool that needs permission on the PHP upload_tmp_dir folder not on WP_TEMP_DIR. thanks mate! — Sanjeev, Aug 07 '20 at 14:11
To get the appPoolName click on the site in IIS and then click on Basic Settings in the right pane — Schwarz Software, Jun 06 '23 at 13:03

score 9 · Answer 3 · answered May 04 '11 at 17:09

9

You need to give PHP writing permission, not IIS. This means the user account that PHP is running on needs permission (probably the same one IIS is running on).

answered May 04 '11 at 17:09

Andrea

19,134
4
43
65

4

How do you tell which account PHP is running on? – dumbledad Dec 20 '13 at 15:43
1

php-cgi.exe will spawn from w3wp.exe and have the same context. So like tomfumb says above grant the Windows security context 'IIS APPPOOL\MyAppName' write access to the folder in question. – James Green Jul 28 '14 at 01:36
2

To know exactly which user you need to give write permissions to, check my answer. – Tristan CHARBONNIER Aug 16 '15 at 10:18

Add writing permission to PHP on IIS 7

3 Answers3

Linked