Isolating Applications with Application Pools

If your applications run on Windows Server 2003, you can use application pools and configure each application to run in its own worker process that provides process-level isolation. By default, all applications run in a default application pool. With application pools, you can configure each process to run using a separate identity and, as a result, you do not need to use impersonation.

 Task   To provide process level isolation

1. Create a set of new Windows accounts, one per application to run each worker process instance.

2. Configure NTFS permissions for each account to ensure that each account only has access to the appropriate file system files and folders, and cannot access critical resources such as operating system tools.

   For more information about configuring NTFS permissions for the anonymous account, see Chapter 16, "Securing Your Web Server."

3. Disable Web application impersonation.

   You can do this in Machine.config or Web.config. To disable impersonation for multiple applications in Machine.config, place <identity> elements inside <location> elements as shown below.

   Use the following configuration. This configuration does not impersonate.

    <location path="Web Site Name/appvDir1" allowOverride="false" >   <system.web>      <identity impersonate="false"   </system.web> </location> 

   Note  

   ASP.NET applications do not impersonate by default.

4. Create new application pools and configure them to run under the new accounts.

   Use IIS 6 to create new application pools with default settings, and use the accounts created in step 1 to configure the identity of each pool, so that each pool runs using a separate identity.

5. Configure each application to run in its own application pool.

   On the Directory tab of each IIS application, choose the application pool for the application to run in.