How to use domain windows user account as app pool identity

I will be using a domain windows account(maintained in Active Directory) as Application pool identity in my web server. So i want the account to be a member of IIS_WPG or IIS_IUSRS group. My question is where to do it? in Active Directory or in the web server itself? If i modify the Active Directory, so that the user is part of IIS_WPG/IIS_IUSRS, should be more than enough? or i should edit local 开发者_运维问答users/group(in web server) to make sure i add the domain user to IIS_WPG or IIS_IUSRS group?

I'm not sure about adding via Active Directory as a blanket fix.

We used this method for IIS 6:

1. Add User to IIS_WPG group: Go to Computer Management on the box hosting the site, Local Users and Groups > Groups, right-click IIS_WPG > Add to Group, then add the windows account, Apply, OK.

2. Then allow account to run as service: Admin Tools > Local Security Policy > Local Policies > User Rights Assignment > Log on as a service Properties, Add user, Apply, OK

3. Set App Pool Identity: IIS > App Pool Properties > Identity tab, set as configurable and input user, Apply, OK.

4. Then reboot box.

Good resource: Steps for setting up a custom identity of an IIS 6 application pool

1. In the identity tag and use your windows domain and windows user name in the web.config file

2. In the IIS Server set the pool identity as ApplicationPool.

3. Disable anonymous authentication for the web application. Enable Impersonation and Windows Authenticaton. for the web Application in the IIS Box

On Windows Server 2012 (in my case) one have to

• add user to domain controller
• set the Domain Account as custom apppool identity on the Webserver
• set the option LoadUserProfile = True in the advanced properties of the Application Pool.

Right click on your Application Pool, in Process Model section, identity (first one) go in and select the second radio button which is Custom account and enter your desire account and password