Cannot read configuration file due to insufficient permissions

Question

I've recently encountered an error trying to host my asp.net site with IIS. I have found a solution that many swear by.

Solution:

Add IIS_IUSRS with Read permission on files in the folder

Change IIS authentication method to BasicAuthentication

refresh the website. It will work

(http://vivekthangaswamy.blogspot.com/2009/07/aspnet-website-cannot-read.html)

What do I add to my web.config file though? I've never had to edit it before. Here is its current contents:

<?xml version="1.0"?>
<!--
  For more information on how to configure your ASP.NET application, please visit
  http://go.microsoft.com/fwlink/?LinkId=169433
  -->
<configuration>
    <connectionStrings>
  <add name="DefaultConnection" connectionString="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Database.mdf;Integrated Security=True;User Instance=True"
   providerName="System.Data.SqlClient" />
 </connectionStrings>
 <system.web>
  <compilation debug="true" strict="false" explicit="true" targetFramework="4.0"/>
    </system.web>
</configuration>

My error is:

Config Error: Cannot read configuration file due to insufficient permissions
Config File: \?\C:\Users*****\Documents\Visual Studio2010\WebSites\PointsForTime\web.config

Please see the install rewrite module. save yourself some hours — regisbsb, Jan 18 '16 at 17:14
In addition to the other answers, note that encrypting filesystem (EFS) can also interfere with IIS. — G-Wiz, Sep 28 '16 at 20:04
I did this ad now local host is asking for a password, nearest I've getting so far to this working thanks — Paul Ledger, Feb 16 '17 at 13:05
My solution would be to run the commands from command line opened with administrator privileges. To do this, find command prompt, right-click it, and click run with administrator privileges. — David Waddington, Jun 06 '16 at 10:25
For me there was no IIS_IUSR, I did the same for Authenticated User and it worked — Bhanu Chhabra, Mar 07 '18 at 11:16

score 579 · Accepted Answer · edited Oct 25 '19 at 05:27

579

There is no problem with your web.config. Your web site runs under a process. In iis you can define the identity of that process. The identity that your web site's application pool runs as (Network Services, Local System, etc.), should have permission to access and read web.config file.

Update:

This updated answer is same as above, but a little longer and simpler and improved.

First of all: you don't have to change anything in your config file. It's OK. The problem is with windows file permissions.

This problems occurs because your application can not access and read web.config file.

Make the file accessible to IIS_IUSRS group. Just right click web.config and click properties, under security tab, add IIS_IUSRS.

So what is this IIS_IUSRS thing?

Your web site is like an exe file. Just like any exe file, it should be started by a user and it runs according to permissions assigned to that user.

When your site is started in IIS, Application Pool of your web site is associated with a user (Network Services, Local System, Etc. ...) (and can be changed in IIS)

So when you say IIS_IUSRS, it means any user (Network Services, Local System, Etc. ...) that your site is running as.

And as @Seph mentioned in comment below: If your computer is on a domain, remember that IIS_IUSRS group is a local group. Also make sure that when you're trying to find this user check the location it should be set to local computer and not a corporate domain.

edited Oct 25 '19 at 05:27

Sнаđошƒаӽ

13,406
11
67
83

answered Apr 10 '11 at 23:34

Afshin Gh

7,328
2
21
40

84

For others, it's worth pointing out that the default usually is `IIS_IUSRS` and to make sure that when you're trying to find this user check the location it should be set to local computer and not a corporate domain. – Seph Apr 09 '12 at 07:25
How would one go about doing this? – onetwopunch Jun 25 '12 at 18:35
what Seph meant is you simply need to click "Path" and instead of whole directory choose your local machine. there you can find the IIS_IUSRS user. (I hope "Path" is the correct translation as I have german windows) – Amc_rtty Jul 09 '12 at 16:52
4

Good answer, and here's an additional tip - running IIS7 on Win7 in a domain, you might not find IIS_IUSRS in the local group if you try finding with 'Check Names...'. Don't worry - just type IIS_IUSRS in full and hit OK, and all will be well. – Eight-Bit Guru Apr 23 '13 at 09:57
found out that you can click on a directory and add permission for everyone, by Right click on the specific folder(where your web.config is saved), tab on security, edit, and type Everyone and click on check name give it full control on every permission and Bingo! you are in business – Jack M Jun 05 '13 at 19:34
@JackM: That is not a good idea because giving access to everyone can cause many security related problems. – Afshin Gh Jun 05 '13 at 19:42
it is everyone using the machine not opening the file to the www – Jack M Jun 05 '13 at 20:34
@JackM I don't recommend it. For example: If you add everyone, in a shared hosting environment, other web sites can access your config file. – Afshin Gh Jun 05 '13 at 23:04
@AfshinGh: not that I am starting a new debate, but I am interested in how this can happen, the reason being that I use this kind of configuration on my local dev machine to mirror how my website will look like in a production environment as I am running the website from Project folder of VS2012, instead of running from inetpub as it will be on production – Jack M Jun 06 '13 at 08:14
Adding this IIS_IUSRS group to the permissions didn't solve the problem for me (Win8.1). One of my websites works without my having done this. Subsequent websites that I've added, both totally new and exact copies of the first, working site, do not work. When I add the IIS_IUSRS group to the permissions for web.config (or alternatively, to the whole folder) simply makes the Chrome browser tab hang when trying to render the page. IE continues displaying the previous page. "Waiting for localhost" Any ideas? – Dan Vanderboom Oct 11 '13 at 22:00
I eventually got it to work by changing the Application Pool identity to "Local Service". I don't know if this is a problem, but it's only on my test box, and at this point I'm too frustrated to fight with it any more today. – Dan Vanderboom Oct 11 '13 at 22:06
2

What if you have a shared drive for the path of a site? Does this have an effect? How do you make this work with shared drives? – Kevin Apr 13 '14 at 00:32
2

I had to do this for IUSR. IIS_IUSRS didn't work for me for some reason. – Todd Dec 02 '14 at 01:59
13

While trying to setup a new ASP.Net web site from scratch in IIS 7 onward once you have fixed the error being discussed in this thread you might face an authorization error "HTTP Error 401.3 - Unauthorized" as your next hurdle. To fix that if you have enabled anonymous authentication then change the anonymous user identity from "IUSR" (set as default by IIS) to Application pool identity. To get the edit window for this setting use the "Edit" action from Actions pane in IIS features view for "Authentication" IIS feature. – RBT Dec 23 '14 at 03:33
@Seph To make it recognize IIS_IUSRS as a non domain-joined account, press Ctrl+Break from the Windows desktop, take note of your computer name, and then add the following user under the Web.config security settings: COMPUTER-NAME\IIS_IUSRS. – John Kurlak Oct 14 '15 at 17:02
You should also check for the _read-only_ attribute in the `applicationhost.config` file – Rubens Farias Apr 26 '16 at 20:55
When I attempt to follow these steps by trying to add "IIS_IUSRS" to Web.Config's Group or user names in the Security tab, I get "Name Not Found - An object named "IIS_IUSRS" cannot be found..." – B. Clay Shannon Mar 02 '17 at 18:02
1

We had this recently, after installing a Microsoft security fix. It seemed to have *removed* the read-write Security permission for COMPUTERNAME\USERS on the IIS folder. We added back the permissions, and it all worked again. – Mike Gledhill Jun 16 '17 at 12:35
For me there was no IIS_IUSR, I did the same for Authenticated User and it worked – Bhanu Chhabra Mar 07 '18 at 11:17
@BhanuChhabra this is not a good idea. if you do this in a shared environment, you are granting access to other websites and processes on that server – Afshin Gh Mar 08 '18 at 05:49
@AfshinGh : My bad, forgot to mention it was my local dev/test env. Very true, not recommended for Production and Shared env. Thanks for mentioning. – Bhanu Chhabra Mar 08 '18 at 06:53
I had the same issue, but the problem was not the permissions to the website's folder, but the permissions of C:\inetpub – Bjarte Aune Olsen Apr 10 '18 at 16:18
iis_user have full rights for intpub, what to do? What is going on whit this windows :D This privileges dose not matter at all... – Vasil Valchev Oct 16 '18 at 20:40
While we spent hours to figure out why our web.config could not be read, it turned out we had to install the .NET Core Hosting Bundle. It's a shame the error message didn't point us in that direction. – rolandow Mar 17 '20 at 09:22
@AfshinGh same problem here but there are no "Security" options under my web.config file properties, I opened the properties from the web.config file in my RESTService project inside the solution in Visual Studio...Can I reach it from IIS manager alternatively? – franz1 Nov 19 '20 at 19:09
1

@franz1 right click the file in the windows explorer (windows file manager), not inside the visual studio. You need to set security permissions of the file. – Afshin Gh Nov 19 '20 at 23:19
thank you @AfshinGh! I tried it but I still get a 401.3 error :( – franz1 Nov 20 '20 at 09:08
For me, it worked on giving permission to the entire folder of the artifact where the executable was residing to execute. – Naveen Kumar G C Feb 12 '21 at 07:04

score 78 · Answer 2 · edited Sep 14 '12 at 04:49

78

I had what appeared to be the same permissions issue on the web.config file.
However, my problem was caused by IIS failing to load the config file because it contained URL rewrite rules and I hadn't installed the IIS URL rewrite module on the new server.

Solution: Install the rewrite module.
Hope that saves somebody a few hours.

edited Sep 14 '12 at 04:49

Himanshu Jansari

28,446
26
101
128

answered Sep 10 '12 at 11:59

Jarrod

829
6
7

Yup. The previous server I used this on rewrote the non ssl route to ssl.. so much for a great error message from IIS. `error:` :) +1 Because of instead of requiring SSL, I rewrote the URL to HTTPS incase someobody linked without https. What a conundrum. – Piotr Kula Aug 20 '14 at 20:01
thankyou!!! been faffing about with permissions for hours and it was down to this in the end! – Carl Woodhouse Feb 17 '15 at 13:17
How does one go about installing the IIS URL rewrite module? – B. Clay Shannon Mar 02 '17 at 18:36
2

This was my issue as well--thanks! To install the rewrite module, download it from this page: https://www.iis.net/downloads/microsoft/url-rewrite close IIS, install, restart IIS (just to be safe). – Tyler Forsythe Jul 08 '17 at 16:02
2

@B.ClayShannon use the Web Platform Installer, search for IIS Rewrite – enorl76 Nov 02 '17 at 14:05
Didn't believe it could be this module in my case for a first instance, because I noticed the error only after performing a webdeploy and not when created a new site. Finally tried that and it worked! – martinoss Mar 25 '20 at 12:24
Yep, In my case it was URLRewrite module that was not installed. I spent a part of a day to find this. – Kate Jun 16 '20 at 19:13

score 66 · Answer 3 · edited Jun 25 '18 at 09:48

66

Editor's note: Doing what this answer says is DANGEROUS! The LocalSystem account is a ...

Completely trusted account, more so than the administrator account. There is nothing on a single box that this account cannot do, and it has the right to access the network as the machine (this requires Active Directory and granting the machine account permissions to something)

Changing the Identity from ApplicationPoolIdentity to LocalSystem did the work ;).

I am using win7 64 with IIS 7.5

more about Application Pool Identity in IIS 7.5 and win 7

enter image description here

edited Jun 25 '18 at 09:48

user247702

21,902
13
103
146

answered Jun 21 '13 at 17:10

amd

18,048
6
45
64

Useful answer for IIS 6 as well. Found more information about how to change Application Pool Identity at Microsoft website here: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/f05a7c2b-36b0-4b6e-ac7c-662700081f25.mspx?mfr=true – Manuel Alvarez Mar 02 '15 at 09:40
24

Making this change is a security risk because of the access you are granting this service: https://msdn.microsoft.com/en-us/library/windows/desktop/ms684190%28v=vs.85%29.aspx – WhiteKnight Sep 04 '15 at 08:56
This seems to have been my issue here and changing App Pool Identity to LocalSystem worked as described! – Vasily Hall Aug 09 '16 at 19:13
22

Down-voting this due to the gaping security hole this leaves on the server. You should NEVER run public facing services like IIS under the local system account!!!! You are basically handing the keys to the kingdom for anyone that can hack the server. Seriously DO NOT DO THIS. – Dimesio Dec 28 '16 at 17:55
How do you access this dialog? With my site highlighted in IIS7.5, the "Advanced Settings..." dialog that displays for me is much more spartan than what you show, and only has "General" and "Behavior" sections - no "Process Model". BTW, I don't have a "Local System" available in my list of options. – B. Clay Shannon Mar 02 '17 at 18:34
Had the same error with IIS 10 on WIndows 10 and this fixed it. Thanks! – Libin M Jul 24 '17 at 16:07
5

OMG This answer is SO INCORRECT for security. Moderation intervention is needed. This is a HORRIBLE idea. Imagine any file access that is specified on the querystring... boom... anybody can READ web.config and IIS will happily serve it to the world. DO NOT USE THIS ANSWER. – enorl76 Oct 31 '17 at 04:51
Changing the Identity from ApplicationPoolIdentity to LocalSystem did the work for me as well. thanks – santa029 Dec 14 '17 at 21:59
1

The author of this answer should really consider deleting it. – David Walschots Jun 11 '19 at 11:57

score 58 · Answer 4 · answered Sep 22 '15 at 12:49

58

I had the same problem when I tried to share the site root folder with another user. Some folder lost the permission. So I followed the steps to add permission to IIS_IUSRS group as suggested by Afshin Gh. The problem is this group was not available for me. I am using windows 7.

What I did I just changed some steps:

Right click on the parent folder (who lost the permission),
Properties => Security =>In "Group or user names:",
Click Edit...
Window "Permission for your folder" will be opened.
In "Group or user names:" press ADD... btn,
Type Authen and press Check Names,
You will see the complete group name "Authenticated Users"
Press ok => apply.
This should enable privileges again.

That worked for me.

answered Sep 22 '15 at 12:49

zwitterion

3,958
9
43
64

2

This worked for me. This should be the accepted answer. I tried the other methods, they don't work. – GunWanderer Apr 20 '17 at 00:17
1

Tried all other solutions won't work until this one. – jenna_3108 Jun 18 '19 at 07:12
2

Okay, I think I have an explanation for *why* this works. Some devs host their code at `C:\ ` i.e. `C:\Dev` or `C:\Code`, etc. The security group `Authenticated Users` is granted on the `C:\ ` and propagated to child folders. However, at the `C:\Users` folder, this propagation stops. So devs like myself who host their code inside the home folder have to grant access to `Authenticated Users` to those IIS root folders in order for IIS to work. – Colin Oct 24 '19 at 23:13
when I click check Names, it asks me credentials. I am not sure which user credentials are expected here.Can anybody help? – RSB Apr 09 '20 at 13:27

score 18 · Answer 5 · answered Apr 10 '11 at 23:28

18

You don't have to change anything in your web.config.

The problem is file system permissions. Your file permissions do not allow the IIS_IUSRS user to access web.config (or probably any of the files). Change their file permissions in windows to allow the IIS_IUSRS account to access it.

answered Apr 10 '11 at 23:28

Erik Funkenbusch

90,480
27
178
274

1

I had a similar problem. If anyone ever can't find the IIS_IUSRS user, check the location. Mine defaulted to the corporate domain, so I didn't find it right away because I forgot to check to see where it was looking. – jgreep May 09 '11 at 16:57
@Mystere Man I have the same issue. I changed the permissions and then tried. Still I get the same error. :( – Rauf Nov 08 '11 at 12:46
"(or probably any of the files)" works for me, allowing IIS_IUSRS account access to web.config is not enough, I need to enable it to have access to all files in the site helps. – Tuyen Nguyen Feb 22 '13 at 14:34
3

I had to do this for IUSR. IIS_IUSRS didn't work for me. – Todd Dec 02 '14 at 01:59
Thanks. I have granted 'Everyone' with full permission on the Web app folder and it works. – Minh Nguyen Mar 10 '16 at 17:47

Kurt Van den Branden · Answer 6 · 2016-10-24T07:55:10.783

17

Make the file accessible to the IIS_IUSRS group. Right click your web.config, expand properties, and under security tab, add IIS_IUSRS. Give the group read/write access.

When the group is NOT available, replace IIS_IUSRS by ComputerName\IIS_IUSRS

edited Oct 24 '16 at 07:55

answered Jan 26 '16 at 16:51

Kurt Van den Branden

9,082
8
60
72

+1 Good tip. The accepted answer is good, but neglects to mention that you might need to add your computer name in front of 'IIS_IUSRS', which is what got me past this. – Ralph Lavelle Feb 19 '16 at 11:42
This ("When the group is NOT available") had my hopes up, but even when I prepended the computer name ("IBM-TAMMYFAYEBAKER.platypus.local\IIS_IUSRS") I still get the same error. I tried full computer name, too, but it wouldn't even accept that as a valid user. – B. Clay Shannon Mar 02 '17 at 18:47

score 14 · Answer 7 · answered Jun 23 '15 at 00:18

14

When you grant permissions to IIS_IUSRS you should check that in the IIS/Authentication section of your Web Application, the Anonymous Authentication Credentials uses Application Pool Identity and not IUSR.

enter image description here

answered Jun 23 '15 at 00:18

Carlos

351
3
7

Where can I get this interface? – Mar 30 '16 at 16:06
In the Features View tab on your Web Application: Authentication – Carlos May 17 '16 at 00:29
This answer should be part of the accepted answer cause without this you also need to add IUSR in the access list of the website's folder – Laurent S. Jan 18 '20 at 10:00

score 13 · Answer 8 · answered Jan 08 '12 at 09:21

13

Go to the parent folder, right-click and select Properties. Select the Security tab, edit the permissions and Add. Click on Advanced and the Find Now. Select IIS_IUSRS and click OK and OK again. Make sure you have check Write. Click OK and OK again.

Job done!

answered Jan 08 '12 at 09:21

Quinny

211
2
2

21

What on earth is with recommending Write access when Read is all that's needed? /downvoted – TristanK Feb 23 '12 at 02:24
2

The only IIS* I have is IIS_WPG – B. Clay Shannon Mar 02 '17 at 18:40
1

@B.ClayShannon Me too. I only have IIS_WPG – Fortune Jun 15 '17 at 13:02

score 7 · Answer 9 · answered Nov 07 '11 at 14:35

7

For some reason your web.config is set as read only. Uncheck the readonly option of web.config file.

answered Nov 07 '11 at 14:35

Luis

109
1
1

If your permission is full access and still get the error, this is the correct answer (y). – Vasil Valchev Oct 16 '18 at 20:41

score 6 · Answer 10 · answered Jan 10 '14 at 17:58

6

I needed to add permissions to IUSR (in addition to ISS-IUSRS, as others have suggested). (See also: http://codeasp.net/blogs/raghav_khunger/microsoft-net/2099/iis-7-5-windows-7-http-error-401-3-unauthorized)

answered Jan 10 '14 at 17:58

coberlin

400
4
5

score 4 · Answer 11 · answered Sep 25 '12 at 15:10

4

I used subst to create a mapping from D: to C: in order to keep the same setup as other developers in the team. This also gave me same errors as described. Removing this fixed it for me.

answered Sep 25 '12 at 15:10

Sniipe

105
1
7

Tom McDonald · Answer 12 · 2017-05-24T17:03:27.613

3

The accepted solution didn't for me. I use a Git repo and it cloned to the following folder

c:\users\myusername\source\repos\myWebSite

I made new IIS website and pointed it at the path. Which didn't have the iis_iusrs permissions suggested in the accepted solution. When I added the permissions it still didn't work.

It only started working when I gave the following permissions to the 'Users' group and inheritance cascaded the permissions to web.config. Probably should have applied it just to the web.config to reduce attack surface area.

edited May 24 '17 at 17:03

answered May 24 '17 at 15:41

Tom McDonald

971
1
12
26

Had exact the same situation. This helped. – Roemer Apr 11 '18 at 08:53

Doruk · Answer 13 · 2019-05-31T06:17:28.073

3

All answers given are valid and working under different circumstances.

For me, restarting Visual Studio worked.

edited May 31 '19 at 06:17

answered Jan 08 '18 at 08:05

Doruk

844
9
25

score 3 · Answer 14 · answered Jul 08 '20 at 09:31

Instead of giving access to all IIS users like IIS_IUSRS you can also give access only to the Application Pool Identity using the site. This is the recommended approach by Microsoft and more information can be found here:

https://support.microsoft.com/en-za/help/4466942/understanding-identities-in-iis

https://docs.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities

Fix:

Start by looking at Config File parameter above to determine the location that needs access. The entire publish folder in this case needs access. Right click on the folder and select properties and then the Security tab.

Click on Edit... and then Add....

Now look at Internet Information Services (IIS) Manager and Application Pools:

In my case my site runs under LocalTest Application Pool and then I enter the name IIS AppPool\LocalTest

Press Check Names and the user should be found.

Give the user the needed access (Default: Read & Execute, List folder contents and Read) and everything should work.

I tried giving read permissions for IIS_IUSRS and "Authenticated User", but it only worked after I gave it to my application app pool. — Tulio F., Mar 16 '21 at 18:45

score 2 · Answer 15 · answered Jan 16 '14 at 16:02

We had a website running with a specific identity in the apppool, only after giving that user read access to the folder containing the web.config would it work. We tracked this down after adding the 'everyone' user with read and everything worked fine.

score 2 · Answer 16 · edited May 23 '17 at 11:47

For me the error turned up during Debugging on my local machine and turned out to be related to the base web.config, which is initiated by the .NET Framework when compiling the website. My C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config file had an unrecognized element (folderLevelBuildProviders). Fixing this fixed the 500.19 error.

See this: IIS Manager can't configure .NET Compilation on .NET 4 Applications

score 2 · Answer 17 · answered Jun 03 '15 at 17:28

2

Changing the Process Model Identity to LocalSystem fixed this issue for me. You can find this setting if you right click on the application pool and chose "Advanced Settings". I'm running IIS 7.5.

answered Jun 03 '15 at 17:28

jshoaf

113
1
4

score 2 · Answer 18 · answered Oct 05 '16 at 07:30

2

Right click Web.Config => Tab Security => Button Edit => Button Add => Button Advanced => Button Find Now = > In Search results select your group(in our case " IIS_IUSRS") => Ok => Ok=> Ok

answered Oct 05 '16 at 07:30

Igor Levkivskiy

301
4
12

score 2 · Answer 19 · answered Oct 21 '16 at 22:35

This happened to us when the IIS application has a Virtual Directory with a Physical Path that contains forward-slashes / instead of backslashes \. This was accidentally done using a powershell management API for IIS during our continuous delivery process.

Bad Config Example - `applicationHost.config`

<application path="/MySite/MyService" applicationPool="MyAppPool" enabledProtocols="http">
    <virtualDirectory path="/" physicalPath="C:\inetpub\MySite/MyService" />
</application>

Make sure the physicalPath attribute does not contain forward-slashes /, only backslashes \

Corrected Config Example - `applicationHost.config`

<application path="/MySite/MyService" applicationPool="MyAppPool" enabledProtocols="http">
    <virtualDirectory path="/" physicalPath="C:\inetpub\MySite\MyService" />
</application>

In my case the physical path had a double back slash eg `C:\inetpub\MySite\\MyService`. Changing it to a single back slash worked — Ben Anderson, Mar 23 '18 at 21:01

score 2 · Answer 20 · answered Jan 19 '17 at 09:36

I have solved this by adding read permission to folder for application pool user (WIN SERVER 2008 R2): C:\Windows\System32\inetsrv\config

A little background: Our server has been hacked using classical error where app user had more permissions that it should (local admin).

To fix it we created new domain user that had only permissions on application folder, with min needed rights and assigned it as application pool user. than we hit in the issue and this was solution to our problems.

score 2 · Answer 21 · answered Feb 16 '17 at 11:12

2

Shift your project to some drive other than C: Worked for me with the same error.

answered Feb 16 '17 at 11:12

Talha Imam

821
16
19

score 2 · Answer 22 · answered Jan 04 '19 at 15:17

2

This can happen if your application is in a virtual directory and the path to the files is a mapped drive.

If you change the path to the files to a local drive, this will solve it, if that indeed is your problem.

answered Jan 04 '19 at 15:17

UKcentric

31
2

score 1 · Answer 23 · answered Oct 23 '14 at 20:53

1

I was receiving the "Cannot read configuration file due to insufficient permissions" as well. Turns out the ISAPI and CGI Restrictions in IIS for both ASP.NET 4.0 32bit and 64bit was set to deny. Marking them both to Allowed fixed my problem.

answered Oct 23 '14 at 20:53

Earl

79
1
4

score 1 · Answer 24 · answered Feb 12 '20 at 20:35

The above answers were helpful, but in case this helps anyone - I had this exact problem, and it turned out that I was (windows networking) sharing the root folder that the site was being hosted from. We killed the share, and added the Users permission to read/execute and it worked again just fine.

I suspect the share messed it up.

score 0 · Answer 25 · answered Jun 26 '15 at 05:52

Had this issue with a Virtual Application. All the permissions were set. IIS_IUSRS, AppPoolIdentity and then gave full access to Everyone. Nothing worked. Restarted apppool, site and IIS but No go.

Deleted the virtual application and added it again from scratch and it started working.

Wish I knew what solved it.

score 0 · Answer 26 · answered Jul 10 '15 at 12:21

0

check if the file is not marked as read-only, despite of the IIS_IUSRS permission it will display the same message.

answered Jul 10 '15 at 12:21

Syed Umar Ahmed

4,963
1
18
22

score 0 · Answer 27 · answered Sep 16 '15 at 15:23

I had this error message that turned out to be due to my physical folder being located on a network drive as opposed to the local drive. It seems the permissions on such drives by default can be different. For example, while the local drive location gave permission to the users of the local computer, the network location did not.

Further, the accepted answer does not work for such a case. The local users or IIS users were not an available to assign permissions to. The solution was to move the physical folder to the local drive.

score 0 · Answer 28 · answered Jul 14 '16 at 07:33

0

I had the same issue and after doing all the stuff written here as answers, it still reproduced. The second half of the issue was the fact that .NET was turned off under "Turn Windows features on or off"

answered Jul 14 '16 at 07:33

Bogdan Mates

460
4
8

Dinesh Rajan · Answer 29 · 2017-03-02T02:56:43.370

0

In my case, I was trying to host pages from a mapped drive (subst). The issue is that the subst was run under my account and the IIS user is not able to see the same drive

edited Mar 02 '17 at 02:56

answered Sep 21 '16 at 18:50

Dinesh Rajan

2,038
20
14

score 0 · Answer 30 · answered Oct 28 '16 at 15:50

0

Sometimes if it is a new server you need to configure or install ASP.NET feature on IIS for it to be able to read your web.config file.

In my case this was the reason.

answered Oct 28 '16 at 15:50

SanthoshM

471
4
5

score 0 · Answer 31 · answered May 15 '17 at 10:32

0

I gave permission and used ICACLS.exe but didn't work. Then I changed the physical path and it worked successfully.

(IIS 8.5 windows 2012 R2)

answered May 15 '17 at 10:32

Adem Aygun

408
2
6
17

score 0 · Answer 32 · answered Jun 16 '17 at 07:00

Certainly, this is an issue with permissions. I took following steps and it worked for me.

select your website or application in left corner. In most cases it would be under Default web site.
click on Basic settings on right corner in IIS Manager 7 or above.
click connect as button.
Use "Specific User", Click on set button.
Enter your username and password. like Domain\username. for me it was like ABC\rrajkumar, enter password.
restart IIS, browse your website. It should work now.

score 0 · Answer 33 · edited Jun 20 '20 at 09:12

0

Go to IIS, (sites)
Right click on project inside the sites.enter image description here

and click on edit permission.

Go to security.
click on edit button.
click add button. type COMPUTER_NAME\IIS_USERS

or
click advance.
click find now button.

and there is option to choose. choose IIS_USERS and click ok...ok....ok .

edited Jun 20 '20 at 09:12

Community

1
1

answered Aug 04 '17 at 06:46

subash adhikari

21
4

score 0 · Answer 34 · answered Nov 08 '17 at 16:25

I had this same issue and none of these solutions worked for me. I kept getting the same error and one about "Failed to start monitoring changes" in the event viewer.

The only thing that worked was to copy the folder and rename it back. It must have been a corrupted folder in Windows that IIS/ASP.NET could not access.

score 0 · Answer 35 · answered Nov 27 '17 at 09:36

0

Make sure your web.config file is not marked Read-only

answered Nov 27 '17 at 09:36

Oranit Dar

1,023
12
13

score 0 · Answer 36 · answered Jan 12 '18 at 15:48

I had this issue running on Windows 10 with the App Pool using a microsoftaccount\email@contosa.com account (e.g., signing in to the PC with a Microsoft Account instead of local account).

Apparently on my computer something got corrupted; removing IIS and re-adding it did nothing (because it seems the IIS metabase was not removed). Deleting and recreating the app pool didn't help either.

My solution was just to create a new App Pool with the same settings but a different name. This fixed the issue for me; apparently something got corrupted with the apppool which even deleting it and re-adding it with the same name would not fix.

score 0 · Answer 37 · answered Nov 18 '18 at 04:40

0

I was running a website at localhost/MyApp built and run through Visual Studio - via a Virtual Directory created by Visual Studio itself.

The "solution" for me was to delete the Virtual Directory and let Visual Studio recreate it.

answered Nov 18 '18 at 04:40

WernerCD

2,044
4
28
44

score 0 · Answer 38 · answered Jan 22 '19 at 08:10

I tried most of the previous suggestions but in vain. I can't reload the website, so I edited the .csproj file and changed the port number and it worked immediately:

 <WebProjectProperties>
      <UseIIS>True</UseIIS>
      <AutoAssignPort>True</AutoAssignPort>
      <DevelopmentServerPort>**4000**</DevelopmentServerPort>
      <DevelopmentServerVPath>/</DevelopmentServerVPath>
      <IISUrl>http://localhost:**4000**/</IISUrl>
      <NTLMAuthentication>False</NTLMAuthentication>
      <UseCustomServer>False</UseCustomServer>
      <CustomServerUrl>
      </CustomServerUrl>
      <SaveServerSettingsInUserFile>False</SaveServerSettingsInUserFile>
    </WebProjectProperties>

Editing .csproj file

score 0 · Answer 39 · answered May 29 '20 at 18:33

0

If you are the one like me who cannot find IIS_USR to give access to the config file, just give permissions to ‘Everyone’ at the root folder

answered May 29 '20 at 18:33

varnsy

1

1

That will be the most ridiculous and unsecure thing to do, ever! – Ruchira Feb 25 '21 at 04:44

score 0 · Answer 40 · answered Jul 06 '20 at 06:22

0

I set the .NET CLR version to No Managed Code and everything started to work fine.

answered Jul 06 '20 at 06:22

Nasko

21
3

Cannot read configuration file due to insufficient permissions

40 Answers40

Bad Config Example - `applicationHost.config`

Corrected Config Example - `applicationHost.config`

Linked

Related

Cannot read configuration file due to insufficient permissions

40 Answers40

Bad Config Example - applicationHost.config

Corrected Config Example - applicationHost.config

Linked

Related

Bad Config Example - `applicationHost.config`

Corrected Config Example - `applicationHost.config`