NETWORK SERVICE variable

[5aclockshadow]

Hi all,

I'm new to this forum so forgive me if this info is already on here.

I need to know what InstallAware's NETWORK SERVICE username variable is. We have created a setup to install a website and we need to give the NETWORK SERVICE username permissions to the following directory:

C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727

Anybody have any idea what it is?

[Chris Miller]

You can use the IA script command "Set Access Control" and in the "User Accounts/Groups" groupbox control, set the "Named User Account/Group" checkbox and enter "NETWORK SERVICE". You would have to set the "Object path" entry field to the appropriate folder and "Object Type" to "File System". It's documented in the help file.

I am curious, why are you giving NETWORK SERVICE permissions on the .NET Framework folder? If your web app (or any other web app on that box) is compromised, you have just lost control over the .NET Framework.

[5aclockshadow]

You can use the IA script command "Set Access Control" and in the "User Accounts/Groups" groupbox control, set the "Named User Account/Group" checkbox and enter "NETWORK SERVICE". You would have to set the "Object path" entry field to the appropriate folder and "Object Type" to "File System". It's documented in the help file.

I am curious, why are you giving NETWORK SERVICE permissions on the .NET Framework folder? If your web app (or any other web app on that box) is compromised, you have just lost control over the .NET Framework.

Thanks.

The reason we are doing this is because our web app doesn't seem to work w/o that permission. We were giving EVERYONE permissions...

[Chris Miller]

A .NET app should not need write access on that folder. What are you doing that needs that level of access? ASP.NET apps do need read/write/modify rights on "%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files", but that should be already handled by the registration of ASP.NET. if that is not set, the customer should be using aspnet_regiis.exe to reset the permissions.

When you install an ASP.NET app, you should only have to worry about the access rights on your virtual folder and/or sub-directories. If your installer makes changes in %SYSTEMROOT%, you run the risk of global IT policies and/or procedures resetting your changes after the fact.

[5aclockshadow]

Your right, it's the "%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files" directory that needs access but it doesn't seem to be set automatically.

You're saying I can run aspnet_regiis.exe from the InstallAware setup to correct it? Exactly what permissions will be set on which user(s) by running this command?

Thanks for the help!