How to Configure a Custom IIS Application Pool Identity
Applies to: Windows Server 2019, 2022 and 2025.
A custom service account is needed only when an application must access network resources under a specific identity. Prefer virtual accounts or gMSA where supported.
Web-server changes can expose data or interrupt production traffic. Use backups, least privilege and a staged validation path. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Confirm vendor support.
- Create a least-privilege service identity.
- Grant Log on as a batch job only through supported policy.
- Protect credentials and plan rotation.
Procedure
Step 1: Inspect current pool
Read identity type and state.
Get-ItemProperty IIS:\AppPools\PortalPool -Name processModel.identityType
Get-WebAppPoolState PortalPoolStep 2: Stop pool
Pause requests during identity change.
Stop-WebAppPool PortalPoolStep 3: Configure identity
Use IIS Manager for a protected credential entry, or configure a gMSA-supported design without storing a password in scripts.
Step 4: Grant resource access
Assign the service identity only required NTFS, share and database permissions.
Step 5: Start and test
Start pool and exercise application workflows.
Start-WebAppPool PortalPoolVerification
Check pool state, worker process and application logs.
Get-WebAppPoolState PortalPool
Get-WorkerProcess
Get-WinEvent -LogName Application -MaxEvents 50 | Where LevelDisplayName -Eq 'Error'Rollback
Restore ApplicationPoolIdentity or the previous service identity and resource ACLs, then recycle the pool.
Security notes
Do not place service-account passwords in web.config, scripts or task notes.
Official references
Explore Netcloud24 Canada.
