What about security if I change application pools identity to local system?

0

I developed asp.net application to read and scan files from a scanner but when I upload it to IIS (windows 10 X64 is my test machine) I got this error:

Creating an instance of the COM component with CLSID {E1C5D730-7E97-4D8A-9E42-
BBAE87C2059F} from the IClassFactory failed due to the following error: 
80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).

After some researching on the internet i found this article and i checked all the steps and the only solution that works was that "In IIS if I change application pool identity from ApplicationPoolIdentity to Local System it works".

Now the question is that is it decrease my security? whats is the deference between these two types of identities?

c#
application-pool
iis-8.5
asked on Stack Overflow Jul 19, 2018 by motevalizadeh

1 Answer

1

If you run as Local System, you are running code, accessible from the internet as "Local System", which is just that, your code is running as if it's the operating system (i.e., it can do everything an admin on the box can do - and a little more). In general, the advice is "don't do that" - if someone compromises your application, they get to own your box.

Talk to your plugin vendor and ask his advice on how to do this.

answered on Stack Overflow Jul 19, 2018 by Flydog57 • edited Jul 19, 2018 by Flydog57

User contributions licensed under CC BY-SA 3.0