“NT 当局\网络服务” 不继承本地组权限？
我们正在删除使用 ASP.NET 网页上传到我们服务器的图像。 该站点在 IIS 中的“NT AUTHORITY\NETWORK SERVICE”下运行。
在 IIS 服务器上，我们创建了一个本地组“Full_Access”，并向其中添加了“NT AUTHORITY\NETWORK SERVICE”。 该组对文件启用了 NTFS 修改权限。
当我们从应用程序中删除文件时。 该文件不会被删除。
如果我们将“NT AUTHORITY\NETWORK SERVICE”文件显式添加到该文件并授予修改权限，而不是依赖它从其所在的本地组继承权限，那么它就可以正常工作。
我们已经在安全选项卡上使用了有效的权限检查，无论哪种方式它都应该具有权限吗？ 但实际上只有我们直接授予服务帐户权限才有效？
是否有某种原因“NT AUTHORITY\NETWORK SERVICE”不继承其所在本地组的权限？
We are deleting images that have been uploaded to our server using an ASP.NET web page. The site is running under 'NT AUTHORITY\NETWORK SERVICE' in IIS.
On the IIS server we have created a local group 'Full_Access' that we have added the 'NT AUTHORITY\NETWORK SERVICE' to. This group has NTFS Modify permission enabled on the file.
When we delete the file from out app. The file does not get deleted.
If we add 'NT AUTHORITY\NETWORK SERVICE' file instead explicitly to the file and give modify permission instead of relying on it to inherit the permission from the local group it is in then it works just fine.
We have used the effective permissions check on the security tab and either way it supposedly has permission? But in actuality it only works if we directly give the service account permission?
Is there some reason 'NT AUTHORITY\NETWORK SERVICE' does not inherit the permissions of the local group it is in?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
为什么不创建一个专用的应用程序池并让它在具有适当权限的普通用户下运行？
Why don't you create a dedicated application pool and have it running under a regular user with the appropriate rights?
将组 IIS_WPG 添加到“Full_Access”组而不是 NETWORK SERVICE。
来自 http://msdn.microsoft.com/en-us/library/ms998320 .aspx：
Add the group IIS_WPG to your 'Full_Access' group instead of NETWORK SERVICE.
From http://msdn.microsoft.com/en-us/library/ms998320.aspx :
只是猜测，但是您尝试过重新启动服务器吗？
组成员身份是在登录过程中确定的。 NETWORK SERVICE 实际上是计算机帐户。 而且我认为它的工作方式与其他帐户不同。 也就是说，当您启动应用程序时它不会登录。 系统帐户（控制iis）只是以其身份启动进程。 这意味着没有登录，也没有组成员资格检查。
Just a guess, but have you tried restarting the server?
The group membership is determined during the login process. The NETWORK SERVICE is actually the computer account. And I don't think that it work in the same way as other accounts. That is, it doesn't login when you start the application. The system account(which control the iis) just start the process under its identity. Which means that there is no login, and no group membership check.