title: User rights needed for IIS 7.5 application pool user (domain user, not the AppPoolIdentity)
body: <p>We have an active directory domain (let's call it <code>foodomain</code>) and a domain user account (<code>foodomain\fooAppPoolUser</code>) used for the IIS application pool identity.  </p>
  
  <p>We want to run the app pool under this user account and not under <code>Network Service</code> or the new <code>AppPoolIdentity</code> as we have to access SQL server and have multiple applications on IIS (with own app pools) accessing different databases.  </p>
  
  <p>The problem is that I can't find a clear HOW-TO explaining, which user rights have to be set for this user account and how IIS has to be setup so that this will work.  </p>
  
  <p>First I got errors (unfortunately I can't remember which ones), then I added <code>fooAppPoolUser</code> to the local admin group (<code>Administrators</code>, I know, was only to test), then it worked. Now I removed the user again, restarted IIS and it still works.  </p>
  
  <p>So I'm confused a bit and would like to know, how the configuration/setup has to be to have it working.</p>
  
  <p>Somwhere I read, that the account needs to have the "<em>Impersonate a client after authentication</em>" user right. That's the reason I added the account to the Admin group (the user rights assignment is blocked via group policy, but this can for sure be changed if really needed.</p>
  
  <p>I hope I was clear enough what the question is and hope somebody has an answer.</p>