Instead of using icacls from a command prompt, use a Powershell script, as Powershell allows you to enumerate web sites in IIS and get the physical folder path.
Unfortunately, you cannot set a Powershell script as a startup task. So you'll have to create a regular CMD or BAT file, and then in this file ask Powershell to execute your script.
The CMD file:
PowerShell -ExecutionPolicy Unrestricted .\Setup.ps1 >> %TEMP%\Setup-DebugLog.txt 2>&1
exit /B 0
The first line executes the Powershell script and saves all output to the file Setup-DebugLog.txt. The second line makes sure that the CMD file returns an OK back to Windows Azure, so Azure knows that everything went well in the startup script.
Here is the Powershell script that I use to set folder permissions on the App_Data folder:
Import-Module WebAdministration
cd IIS:\Sites
$dir = Get-ChildItem
$timeout = 0
while ($dir -eq $NULL -and $timeout -lt 11)
{
"IIS Site not ready. Waiting for 2 seconds..."
[System.Threading.Thread]::Sleep(2000)
$timeout++
$dir = Get-ChildItem
}
if ($dir -eq $NULL)
{
"IIS Site still not ready. Aborting."
}
else
{
"IIS site ready."
Set-Location $dir.physicalPath
"Location is $($dir.physicalPath)"
$acl = (Get-Item App_Data).GetAccessControl("Access")
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Network Service", "Modify, Write", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl App_Data $acl
"Permission added."
}
It starts by importing the WebAdministration module, that allows Powershell to interact with IIS. Then it tries to enumerate the web sites. But, here's an interesting challenge. Because, a startup task runs before your web site has been deployed to IIS. So you need to set your startup task to run as a background task, and then wait until the site has been deployed. So the code tries to enumerate the web sites, and if no web site is found, it waits for 2 seconds and then tries again. It does this for 20 seconds total and then times out.
If the web site is ready, then the physical path is found and a FileSystemAccessRule is added to the ACL of the App_Data folder. You can modify the permissions added to suit your needs.
Note that this script expects there to be only 1 site in IIS. If you deploy more than 1 web site, this script might not work and you'll have to adapt the code.
For completeness, here is the XML you should add to your ServiceDefinition.csdef:
<Startup>
<Task commandLine="Setup.cmd" executionContext="elevated" taskType="background" />
</Startup>
Both Setup.cmd and Setup.ps1 should be placed in the root of your web site. If you would like them to be placed in a subfolder of your web site, you can do that, but then you'll have to update the commandLine attribute in the Task element to "Subfolder\Setup.cmd", and you'll need to update the path to the Powershell file in the CMD file:
PowerShell -ExecutionPolicy Unrestricted .\Subfolder\Setup.ps1 >> %TEMP%\Setup-DebugLog.txt 2>&1
Also, note that there is some differences in calling the Powershell script between Powershell v1 and v2. If I recall correctly, Windows 2008 on Windows Azure runs Powershell v1, and Windows 2008 R2 and newer runs Powershell v2. So, if you're using Windows 2008 on Azure, you'll need to change the line that calls the Powershell script, as there is some difference in setting the execution policy.
