Guidelines for Creating Application Pools

  • Article

Applies To: Windows Server 2003, Windows Server 2003 with SP1

Consider the following guidelines when you create application pools:

  • To isolate Web applications on a Web site from Web applications on other sites running on the same computer, create an individual application pool for each Web site.

  • To improve application security, you can specify a unique user account (process identity) for each application pool. If you specify a unique user account, be sure to add that account to the IIS_WPG group. When you use a built-in account, use Network Service if possible because it offers a better balance between security and functionality.

    Note

    If you specify a large number of unique user accounts, your Web server might reach a limit to the number of worker processes you can start under separate identities, in which case, all subsequent application pools fail with a message of Service unavailable.

    The use of unique user accounts also improves security auditing capabilities, because you can more easily trace security events to the corresponding applications that use the security context — that is, the process identity —of the account listed in the security events. For information about auditing security events, see Auditing in IIS 6.0.

  • If you want to configure an application to run with its own unique set of properties, create a unique application pool for that application.

  • If you test an application on the same server on which the application is running, create separate application pools and be sure to use different virtual directories for the test and production versions of the application. Using a test application pool for the test virtual directory helps to isolate the test version of the application.

    By running the test version in a separate application pool, you reduce the risk of the test version crashing or corrupting the production version because the applications are separated by process boundaries. However, separation by application pool does not protect any shared resources that both versions use, such as shared COM components or common data sources (for example, flat files, databases, or registry keys). You can improve the isolation of COM components by using side-by-side assemblies, but you must segregate data sources by some other means to completely isolate the applications. For information about using side-by-side assemblies, see Configuring Applications to Use COM+ Services.