CODEWITHSUNDEEP
powershelliiswindows-server-2016
TheEdge
TheEdge

Reputation: 9881

Insufficient Permissions To Start An IIS App Pool - Even when user is part of the administrators group

I am on a Windows 2016 Server / IIS 10 and want to start an app pool using Powershell. This SO post means all that is involved is:

(Get-IISAppPool "name").Recycle()

However now even though the user in question is part of the local Administrators group on the machine I get permission denied:

enter image description here

So while the original post indicates the user should be part of the "IIS Admins" group I cannot find any evidence of that group.

So what have I missed and what should I do so that the particular user has the necessary permissions to be able to start/stop App Pools?

Upvotes: 1

Views: 1977

Answers (2)

TheMadTechnician
TheMadTechnician

Reputation: 36332

As mentioned by Iftimie Tudor, just because a user is in the Administrators group does not mean that everything they do is run with Administrator privileges. You need to run PowerShell as Administrator to be able to manipulate the AppPool, or what I usually do, if I have a script that has to run as Admin to work right, have it check at the beginning of the script if it has Admin rights, and if not relaunch itself as an elevated session.

#region UACElevation
# Elevate UAC if not already running As Administrator
# Get the ID and security principal of the current user account
$myWindowsID=[System.Security.Principal.WindowsIdentity]::GetCurrent()
$myWindowsPrincipal=new-object System.Security.Principal.WindowsPrincipal($myWindowsID)

# Get the security principal for the Administrator role
$adminRole=[System.Security.Principal.WindowsBuiltInRole]::Administrator

# Check to see if we are currently running "as Administrator"
if (!$myWindowsPrincipal.IsInRole($adminRole))
{
    # We are not running "as Administrator" - so relaunch as administrator

    # Indicate that the process should be elevated
    Start-Process PowerShell.exe -Verb RunAs -ArgumentList "-Command",". '$($myInvocation.MyCommand.Definition)'"

    # Exit from the current, unelevated, process
    exit
}
#endregion UACElevation

Upvotes: 1

TudorIftimie
TudorIftimie

Reputation: 1140

What you bump into is not a powershell issue. It is a windows known dark corner: Adding a user to the admin group does NOT imply that it will get full rights. UAC settings will prevent that. There is an excellent blog on that here

Update: It is a folder permission thing that indirectly affects your IIS command

Upvotes: 0

Related Questions