Profiling a web application needing to run as the Network Service account

Category: How do I?
Date: 17 Jun 2009
Product: ANTS Memory Profiler
Versions: 2,3,4
Platform: ASP .NET hosted in Internet Information Server version 6,7

Some ASP .NET web applications are designed so that they must always run as the Network Service account. If this is the case, these web applications will almost certainly fail if they are being profiled in ANTS Profiler, because it runs the ASP .NET application pool as the SYSTEM account by default.

It is possible to change the web application so that it will execute as the Network Service account by changing the web.config file for that web application. This is in contrast to the instructions for running ASP .NET code as a named user, in which the startup account for the ANTS Profiler Service is simply changed to the credentials that you want to use for the application pool. The reason for this is because the Network Service account typically does not have the privileges to start an IIS application pool, and since the ANTS Profiler services do the work of starting the pool, they must have a high level of access to the operating system.

This can be worked around using ASP .NET impersonation. The result of configuring the web application to impersonate the Network Service account is that the application pool will be started by the ANTS Profiler 3 Service using the SYSTEM account, which has high-level access to the operating system, and afterwards control is handed over to the Network Service account which has minimal local computer rights but is allowed virtually unfettered access to the network.

To impersonate the Network Service account, use Windows Explorer to navigate to the application's virtual directory, locate the web.config file, and open it using notepad.exe or the text editor of your choosing. If the web.config file does not exist, it must be created. The identity impersonate tag should be inserted inside the "'system.web" node of the web.config, for example:

<?xml version="1.0"?>
<configuration>
<system.web>
<identity impersonate="true" userName="NT AUTHORITY\NetworkService" password="" />
<compilation debug="true"/>
<authentication mode="Windows"/>
</system.web>
</configuration>

Because the password is managed internally by Windows, the password should be left as an empty string.

Once the web.config is saved, all actions performed by the web application as it is being profiled using ANTS Profiler will be performed by the Network Service account.

Note that this technique cannot be used on profiling web applications hosted in the development web server, as it does not include impersonation as one of its' features.