47

I'm attempting to read some performance counters from my ASP.NET application. When I do, I get the error "Access to the registry key 'Global' is denied."

I have tried following the instructions here and here, using the user IIS AppPool\DefaultAppPool, which is the identity my app pool is configured to use:

Screenshot of App Pool configuration

I have added that user to the Performance Monitor Users group:

enter image description here

And after adding the user, I restarted my computer. But I am still getting the error.

I have also tried adding the users IUSR and NETWORK SERVICE to the Performance Monitor Users group, but those don't work either. Out of desperation, I tried adding the user "Everyone" to the Performance Monitor Users group, and that actually does work. But my goal is to log statistics from my application in production, and I don't want to add "Everyone" to that group on the production server.

What else needs to happen in order to read the performance counters without generating a security exception?

Community
  • 1
  • 1
Katie Kilian
  • 6,448
  • 5
  • 38
  • 60
  • Have you tried giving permissions for the IIS_IUSRS group of the machine? That is usually what IIS is running when you are using the ApplicationPoolIdentity. – Josh Jul 02 '13 at 13:56

2 Answers2

71

I found the solution. Whereas various links around the Internet tell you to use the identity IIS APPPOOL\DefaultAppPool, that is NOT the full story. That will only work if you are in fact assigning your applications to an app pool named "DefaultAppPool".

This link at ServerFault has the answer. You must use the name of your app pool. In my case, the app pool's name was "staging", so the correct user was IIS APPPOOL\staging. Putting this user in the Performance Monitor Users group fixed my issue.

Community
  • 1
  • 1
Katie Kilian
  • 6,448
  • 5
  • 38
  • 60
  • 16
    Two things to add that I've noticed: * doing nothing or recycling the app pool is not sufficient to pick up the new permissions, but restarting the machine is not needed either. iisreset does the job, though. (Windows 2012 Server in my case). * if you run your app pool as a different identity, adding that identity to the Performance Monitor Users group is all that is needed; i.e. you don't need to add the special IIS APPPOOL user as well. – sellotape Dec 12 '14 at 12:00
  • 1
    what @sellotape mentioned is the same case for Windows 2008 R2 – wonster Jan 30 '15 at 17:18
  • 1
    FYI Im using this in a windows service.... and restarting the service after adding the user to the "Performance Monitor Users" group worked! – Seabizkit Oct 19 '15 at 19:54
  • 1
    on Microsoft Windows Server 2016 (NT 10) I had to reboot the machine - doing iisreset was not enough – AndersMad Dec 23 '18 at 11:01
1

In my case I added the correct Application pool (the one I used for my web site) to Performance Users and Log, but it was still giving me the issue. What I did was to

  • stop my application pool
  • switch my web site so it uses DefaultAppPool
  • restarted the web site
  • switched web site back to correct app pool (which is stopped)
  • started app pool
  • restarted the web site
Muzzy
  • 33
  • 5