title: IIS 7.5 App Pool write permissions denied
body: <p>I have a web application that is running on IIS 7.5 and is having some permission issues. The site will read/serve files, but will not write to any file location under any circumstances.  Ideally, I'd be writing to a non-local share, but I'm currently just trying to get the application to write to a local share/drive.  I've tried setting the identity to a domain service account set up specifically for this application, the built in Network Service account, and the ApplicationPoolIdentity with no luck.  It may be worth mentioning that this server is a virtualized instance running on shared hardware with other servers.</p>
  
  <p>In order to try and grasp the issue, I have granted full control to:</p>
  
  <pre><code>(MACHINE NAME)
  (MACHINE NAME)\Users
  (MACHINE NAME)\IUSR
  (MACHINE NAME)\IIS_IUSRS
  (DOMAIN NAME)\(MACHINE NAME)
  NT AUTHORITY\NETWORK SERVICE
  NT AUTHORITY\SYSTEM
  (APPLICATION POOL IDENTITY)
  (DOMAIN NAME)\(SERVICE ACCOUNT NAME)
  </code></pre>
  
  <p>I have manually verified that all these accounts/groups have full control on the security tab of the file/folder.</p>
  
  <p>The app pool is running under the .NET Framework v4.0 on the Integrated Managed Pipeline.  I've tried it with Load User Profile set to both true and false with no luck.  The site itself is set to application pass-through authentication.</p>
  
  <p>The error thrown in the browser is:</p>
  
  <pre><code>Access to the path 'D:\Dataload\LOG.txt' is denied. 
  
  
  [UnauthorizedAccessException: Access to the path 'D:\Dataload\LOG.txt' is denied.]
  </code></pre>
  
  <p>I've tried writing to that file with it already created as well as not created.  I've also tried calling the file by its server path instead of the drive name.</p>
  
  <p>Viewing the event in Microsoft's Process Monitor:</p>
  
  <pre><code>Operation: CreateFile
  Result: ACCESS DENIED
  Desired Access: Generic Write, Read Attributes
  Disposition: OpenIF
  Options:Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Open No Recall
  Attributes:n/a
  ShareMode: Read
  User:NT AUTHORITY\NETWORK SERVICE (this will correctly change depending on the identity I set)
  </code></pre>
  
  <p>Is there something I am missing with groups or accounts, or possibly an IIS setting I could be overlooking that prevents write access?</p>