IIS Application Pool Crashes due to Temp File Permissions

July 10, 2007 • from Hood River, Oregon • 6 comments

On this page:

My IIS 6 Web Server has been throwing a bunch of nasty errors recently and I've been trying to figure out what the heck is going on. The problem is that apparently App Pools have been crashing hard fairly frequently. In most cases this isn't a big deal as IIS will immediately spin up another app pool, but several of the applications running have some persistent external objects (COM Servers) that get orphaned when the App Pool just crashed hard like this. I logged on to my machine today to find 55 instances of this server running - Ouch!

These errors started recently and I've started seeing constant error messages popping up on my desktop of crashed IIS worker processes which has been wreaking havoc on the server.

The error that keeps showing up in the Event Log is coming from Active Server Pages:

Error: The Template Persistent Cache initialization failed for Application Pool 'DotNet20' because of the following error: Could not create Cache Sub-directory for the Application Pool...

What's odd about this is that this an AppPool that I use for ASP.NET primarily. But as it turns out I recently changed the identity of the pool from a fixed account down Network Service. Apparently there are a few ASP pages in this site and these pages are crashing the App Pool hard.

As it turns out the problem is that ASP fails to get access to this temporary directory:

%systemroot%\system32\inetsrv\ASP Compiled Templates

and this directory requires that the Application Pool's Identity account (Network Service in this case) has full access permissions. I added full rights for Network Service and peace and quiet has returned to my server environment. Sheesh.

Windows Permissions Please

I never really understood the permission settings on temporary directories in Windows. It seems crazy to me that the Network Service account - which is the default IIS identity account now - is not automatically given rights not only in this folder, but also in the temporary ASP.NET temporary files where the same issue exists. The first thing on most systems that I have to do is dig into

%systemroot%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files

and add Network Service to with full permissions. This is a step that just should not be necessary, especially for new users who won't have clue as to what's causing it. Even though the ASP.NET error message points at the temporary files folder it's not real obvious that permissions are at fault.

Grumble, grumble...

The Voices of Reason

Abdu
July 10, 2007

# re: IIS Application Pool Crashes due to Temp File Permissions

Just a little suggestion. I would move all kinds of temporary folders away from the OS partition. Depending on the available free space and unless you're monitoring these folders, the free space can be eaten up before you know it.

Another reason is I create images of the system root drive and I do not want to save junk with the image and causing its size to inflate. I keep the OS partition clean and mean.

For those who don't know, there's a setting in machine.config to have 'Temporary ASP.NET Files' reside in a different drive.

Abdu
July 10, 2007

# re: IIS Application Pool Crashes due to Temp File Permissions

sorry.. I meant monitoring the free space..

Rick Strahl
July 10, 2007

# re: IIS Application Pool Crashes due to Temp File Permissions

I don't think there's much in those folders unless you're hosting a lot of sites. The ASP.NET folders only hold the temporary binary compiled files of an application which doesn't amount to much...

The things you need to worry about are log files and error logs if something goes very wrong - been there done that <s>. Once I caught my drive within 10 megs of being full. That was a lot of fun to get control over. Took almost an hour to get to a command prompt to delete files... <s>

Pablo Fung
July 13, 2007

# re: IIS Application Pool Crashes due to Temp File Permissions

Typically the under that type of configuration "network service" is added to the IIS_WPG group which should have access to all required resources that IIS and asp.net need to properly run.

Rick Strahl
July 13, 2007

# re: IIS Application Pool Crashes due to Temp File Permissions

Thanks for clarifying that Pablo. I had seen reference to this group but couldn't quite make out what it was for in passing. That would make sense. I changed the permissions on the folder at this point and things are back to working, but it still strikes me as odd that this shouldn't be the default (either the permissions set for Network Service or Network Service being part of IIS_WPG and then allowing the group).

Scott
May 18, 2009

# re: IIS Application Pool Crashes due to Temp File Permissions

Hi Rick,

Thanks for the info, it helped me resolve my problem.

One comment from the sys-admin side of the room, FULL access grants a user access control over a resource. If you grant the Network Service account FULL access to a folder, that account can then grant access to other accounts or groups. I suggest you grant CHANGE (add, read, write, modify, delete) access. In this case, FULL access probably carries little risk given that it's the temp folder but better safe than sorry.

Ok, make that two comments, the Network Service account also needs rights to the web site folder tree (by default C:\intetpub\wwwroot\<websitename>). It's one of those things that an experienced IIS admin probably says "duh" about but a newer admin with less experience may not realize it.

Scott

PS I like the fact that it doesn't require an account on your site to post a comment 8-)

Rick Strahl's Weblog