title: Add missing permissions to a specific AppPool identity to allow calling CreateProcessWithLogonW from ASP.NET
body: <p><strong>TL;DR</strong>: I need to call <code>CreateProcessWithLogonW</code> from my IIS-hosted ASP.NET application in order to call an external executable under a different account and delegate a job to it. How can I do this?</p>
  
  <hr>
  
  <p>The reason I can't simply use <code>Process.Start</code> API is that the external executable has a number of COM dependencies that need to be configured. This entails making sure a number of registry entries are there and that the account has required launch and activation permissions which need to be set via DCOM config. Suffice to say this has proven quite unmanageable to do for each of the AppPool identities on every server we have.</p>
  
  <p>The idea is to create a single additional interactive account on each system, configure it as necessary, and then test that the external executable can be successfully run by hand.</p>
  
  <p>The problem now becomes how to start this executable from ASP.NET app and have it run under the new account (just the executable, not the whole ASP.NET app!).</p>
  
  <p>Simply calling <code>CreateProcessWithLogonW</code> results in "Access denied" error, which I've been told is the consequence of the AppPool identity's under-privileged nature.</p>
  
  <p>I've been searching the internet and I've seen a lot of answers on how to grant file-system permissions to AppPool identities. Nothing about permissions for <code>CreateProcessWithLogonW</code>, however, short of changing the identity to something else.</p>
  
  <p>But I'm still wondering if there is a way to configure the AppPool identity for this?</p>
  
  <p>I don't feel comfortable changing the identity to <code>Local Service</code> or <code>Local System</code> as has been suggested elsewhere. I'm worried it could enable unknown additional permissions that are not really needed by the ASP.NET app, which could in turn change the security implications of a rather large code base.</p>
  
  <p>I admit I'm probably having a <em>"Here be dragons!!!"</em> type of reaction to identity changing, but I'm also honestly wondering why I couldn't simply add one additional permission to an existing identity instead?</p>