title: Why is my Web Application not using AppPoolIdentity to log in to SQL Server on same machine?
body: <p><strong>Basic Problem:</strong></p>
  
  <p>I have a web application that accesses a SQL Server database on the same machine. The web app runs under its own app pool - let us call it <code>MyAppPool</code>. If I goto advanced settings in IIS Manager, I can see that <code>MyAppPool</code> runs under <code>ApplicationPoolIdentity</code>. When I make requests to the web app, I can open task manager and verify that the username of <code>w3wp.exe</code> is <code>MyAppPool</code>. In SQL Server, I have added a Windows User <code>IIS AppPool\MyAppPool</code> and given it necessary permissions to read from db. The problem is that I am getting a login failed for <code>DOMAIN\MACHINE$</code> when a logon is attempted to SQL Server. Its beyond me. Why is the app not logging on as <code>IIS AppPool\MyAppPool</code>?</p>
  
  <p><strong>Details:</strong></p>
  
  <p>I know variants of this question have been asked elsewhere, but I am really stuck without a solution. I experimented adding a <code>&lt;identity impersonate="true" /&gt;</code> to the <code>web.config</code>. If I do this, I get a login failed for <code>NT AUTHORITY\IUSR</code>. I have tried accessing the web app from the machine on which it is hosted and get same login error. I am running IIS8, Windows Server 2012, and SQL Server 2012.</p>
  
  <p>Closest question I could find is <a href="https://stackoverflow.com/questions/14870158/why-is-my-mvc-app-trying-to-log-into-my-db-as-my-machine-and-not-as-the-app-poo">Why is my MVC app trying to log into my DB as my machine, and not as the App Pool identity?</a>, and the solutions provided do not work. I cannot change Integrated Security to be false (I had this thing running in the past). Quoting <a href="https://stackoverflow.com/a/15145488/147530">https://stackoverflow.com/a/15145488/147530</a>: </p>
  
  <blockquote>
    <p>ApplicationPoolIdentity uses IIS AppPool\ApplicationPool for local
    access, but DOMAIN\MACHINE-NAME$ for remote access</p>
  </blockquote>
  
  <p>sounds reasonable. Question is why is <code>ApplicationPoolIdentity</code> not using <code>IIS AppPool\MyAppPool</code> identity when db is hosted on same machine??</p>
  
  <p>Quoting another SO post, <a href="https://stackoverflow.com/questions/9686186/iis-application-using-application-pool-identity-loses-primary-token">IIS application using application pool identity loses primary token?</a>:</p>
  
  <blockquote>
    <p>This application also connects to a SQL Server database using
    Integrated Security=true in the connection string. If the database is
    local, then we see that IIS APPPOOL\OurAppPoolName is used to connect
    to the database; if the database is remote, then the machine account
    OURDOMAIN\ourwebserver$ is used.</p>
  </blockquote>
  
  <p>This is the behavior I want, but not getting it, and that is what I am asking in this question - I don't want to give permissions to <code>DOMAIN\MACHINE-NAME$</code> to log onto SQL Server. Quoting <a href="https://stackoverflow.com/a/15445280/147530">https://stackoverflow.com/a/15445280/147530</a>:</p>
  
  <blockquote>
    <p>I think that's a bad idea, however, because it authorizes any program
    running as NetworkService to access the database - not just your web
    applications.</p>
  </blockquote>
  
  <p>I tried one more thing, which was to enable Windows Authentication on IIS8 using this link <a href="http://www.iis.net/learn/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2#ModulesinIIS85" rel="nofollow noreferrer">http://www.iis.net/learn/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2#ModulesinIIS85</a> but this has also not solved the problem.</p>