Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The application pool identity must be defined for each web-site.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-13713 | WA000-WI6040 IIS7 | SV-32520r2_rule | ECSC-1 | High |
| Description |
|---|
| The Worker Process Identity is the user defined to run an application pool. The IIS 7 worker processes, by default runs under the NetworkService account. Creating a custom identity for each application pool will better track issues occurring within each web-site. When a custom identity is used, the rights and privileges must not exceed those associated with the NetworkService security principal. |
| STIG | Date |
|---|---|
| IIS 7.0 WEB SITE STIG | 2011-08-19 |
Details
| Check Text ( C-32866r2_chk ) |
|---|
| This check is only applicable when IIS is running on Windows Server 2008 SP2 or Windows Server 2008 R2. 1. Open the IIS Manager. 2. Click the Application Pools. 3. Highlight an Application Pool to review and click Advanced Settings in the Actions Pane. 4. Scroll down to the Process Model section and ensure the value for Identity is set to ApplicationPoolIdentity. If not, this is a finding. |
| Fix Text (F-29010r2_fix) |
|---|
| 1. Open the IIS Manager. 2. Click the Application Pools. 3. Highlight an Application Pool to review and click Advanced Settings in the Actions Pane. 4. Scroll down to the Process Model section and set the value for Identity to LocalService or custom identity with rights and privileges lower than the NetworkService built-in security principle. |