(This is a question about a vague problem.  I try to present all relevant data, in the hope that someone has helpful information; apologies for the long description.)

**Our web app**

We have a .NET 4 web application running in IIS 7.5 accessing Active Directory and a SQL Server database.

This web application is running under a virtual &#39;app pool identity&#39;, by setting the Identity of the application&#39;s application pool to [ApplicationPoolIdentity](http://msdn.microsoft.com/en-us/library/bb386459.aspx).  A concise description of virtual identities can be found in [a StackOverflow answer](https://stackoverflow.com/a/3680803), and the blog post to which it refers: an app pool identity is just an additional group which is added to the web application&#39;s worker processes which is running as &#39;network service&#39;.  However, [one source](http://forums.iis.net/p/1171701/1957045.aspx#1957045) vaguely suggests that &quot;Network Service and ApplicationPoolIdentity do have differences that IIS.net site documents do not publish.&quot;  So a virtual identity might be more than just an additional group.

We chose to use ApplicationPoolIdentity, as opposed to NetworkService, because it became the default in IIS 7.5 (see, e.g., [here](http://msdn.microsoft.com/en-us/library/bb386459.aspx#attributesAndElementsToggle)), and per Microsoft&#39;s recommendation: &quot;This identity allows administrators to specify permissions that pertain only to the identity under which the application pool is running, thereby increasing server security.&quot; (from [processModel Element for add for applicationPools [IIS 7 Settings Schema]](http://msdn.microsoft.com/en-us/library/bb386459.aspx#attributesAndElementsToggle)) &quot;Application Pool Identities are a powerful new isolation feature&quot; which &quot;make running IIS applications even more secure and reliable. &quot; (from [IIS.net article &quot;Application Pool Identities&quot;](http://learn.iis.net/page.aspx/624/application-pool-identities/))

The application uses Integrated Windows Authentication, but with [`&lt;identity impersonate=&quot;false&quot;/&gt;`](http://msdn.microsoft.com/en-us/library/72wdk8cc.aspx), so that not the end user&#39;s identity but the virtual app pool identity is used to run our code.

This application queries Active Directory using the [System.DirectoryServices](http://msdn.microsoft.com/en-us/library/system.directoryservices.aspx) classes, i.e., the ADSI API.  In most places this is done without specifying an additional username/password or other credentials.

This application also connects to a SQL Server database using `Integrated Security=true` in the connection string.  If the database is local, then we see that `IIS APPPOOL\OurAppPoolName` is used to connect to the database; if the database is remote, then the machine account `OURDOMAIN\ourwebserver$` is used.

**Our problems**

We regularly have issues where a working installation starts to fail in one of the following ways.

 * When the database is on a remote system, then the database connection starts to fail: &quot;Login failed for user &#39;NT AUTHORITY\ANONYMOUS LOGON&#39;. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.&quot;  The previous error is &quot;Error: 18456, Severity: 14, State: 11.&quot;  So it seems that now `OURDOMAIN\ourwebserver$` is not used anymore, but instead anonymous access is attempted.  (We have anecdotal evidence that this problem occurred when UAC was switched off, and that it went away after switching on UAC.  But note that changing UAC requires a reboot...)  A similar problem is reported in [IIS.net thread &quot;use ApplicationPoolIdentity to connect to SQL&quot;](http://forums.iis.net/t/1181039.aspx), specifically in [one reply](http://forums.iis.net/p/1181039/2010748.aspx#2010748).

 * Active Directory operations through ADSI (System.DirectoryServices) start to fail with error 0x8000500C (&quot;Unknown Error&quot;), 0x80072020 (&quot;An operations error occurred.&quot;), or 0x200B (&quot;The specified directory service attribute or value does not exist&quot;).

 * Signing in to the application from Internet Explorer starts to fail, with HTTP 401 errors.  But if in IIS we then put NTLM before Negotiate then it works again.  (Note that access to AD is needed for Kerberos but not for NTLM.)  A similar problem is reported in [IIS.net thread &quot;Window Authentication Failing with AppPool Identity&quot;](http://forums.iis.net/t/1171701.aspx).

**Our hypothesis and workaround**

At least the AD and sign-in problems always seem to go away when switching the application pool from ApplicationPoolIdentity to NetworkService.  (We found [one report](http://forums.iis.net/p/1181039/2010748.aspx#2010748) confirming this.)

Page [&quot;Troubleshooting Authentication Problems on ASP Pages&quot;](http://msdn.microsoft.com/en-us/library/ms180891.aspx) has some suggestions related to primary vs. secondary tokens, and what I find encouraging is that it links the first two of our errors: it mentions `NT AUTHORITY\ANONYMOUS LOGON` access, and AD errors 0x8000500C and &quot;The specified directory service attribute or value does not exist&quot;.

(The same page also mentions ADSI schema cache problems, but everything we can find on that topic is old.  For now we consider this to be unrelated.)

Based on the above, our current working *hypothesis* is that, only when running under a virtual app pool identity, *our web application (IIS? worker process?) suddenly loses its primary token*, so that IIS only has a secondary token, so that all access to Active Directory and SQL Server is done anonymously, leading to all of the above errors.

For now we intend to switch from ApplicationPoolIdentity to NetworkService.  Hopefully this makes all of the above problems go away.  But we are not sure; and we would like to switch back if possible.

**Our question**

Is the above hypothesis correct, and if so, is this a bug in IIS/Windows/.NET?  Under which circumstances does this primary token loss occur?


All Applicationpoolidentity Solutions on Gang of Coders

Total of 1 Applicationpoolidentity Solutions

IIS application using application pool identity loses primary token?