title: IIS Impersonation not working when app pool runs with domain account
body: <p>I have an ASP.net application running in an windows intranet environment.  I have a requirement to perform certain database updates as <strong>the currently logged in user</strong>.  </p>
  
  <p>IIS/server info:</p>
  
  <ul>
  <li>IIS version 10</li>
  <li>Windows server 2019</li>
  <li>ASP.net web forms application</li>
  <li>.NET 4.7</li>
  <li><strong>Windows authentication</strong> enabled </li>
  <li><strong>Impersonation</strong> and <strong>anonymous authentication</strong> are disabled</li>
  <li>The app pool uses <strong>integrated pipeline</strong> </li>
  <li>The app pool runs with a <strong>domain service account</strong> for it's identity, which has rights to access other resources as needed.  </li>
  </ul>
  
  <p>Other details:</p>
  
  <ul>
  <li>All of my database connection strings are set such that <strong>integrated security=true</strong></li>
  <li>in active directory, have configured constrained delegation between the web server and the SQL server, allowing <strong>MSSQLSvc : 1433</strong> and <strong>MSSQLSvc (no port)</strong></li>
  <li>The <strong>domain service account</strong> is a member of the local administrators group on the web server (for testing purposes only)</li>
  </ul>
  
  <p>When i perform the database updates that need to be done as the currently logged in user, i impersonate them in this way:</p>
  
  <pre><code> var windowsIdentity = User.Identity as WindowsIdentity;
   WindowsIdentity.RunImpersonated(windowsIdentity.AccessToken, () =&gt;
   {
       // perform database update
   });
  </code></pre>
  
  <p>This throws an exception - 
  <code>System.Data.SqlClient.SqlException: Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'</code></p>
  
  <p>If i change the app pool identity to use <strong>AppPoolIdentity</strong>  (the default app pool identity) the impersonation works properly.</p>
  
  <p>Why does this impersonation work with <strong>AppPoolIdentity</strong>, but not my <strong>domain service account</strong>?</p>