Classic ASP Upload Folder Permissions on IIS
A file picker can work perfectly while saving fails on the server. Before changing upload code, identify which request needs to write which directory and which Windows identity performs that operation.
Separate a virtual URL from a filesystem path
A URL such as /uploads/photo.jpg is not a Windows path. Server.MapPath resolves an application-relative location, but it does not create a directory or give the process permission to write there. Configure the temporary upload area and permanent storage deliberately; they may be different locations with different retention policies.
For a private attachment store, avoid a directly browsable directory. For public images, prevent script execution in the content area and validate the accepted formats. A permission fix should not turn the application directory into an unrestricted write target.
Determine the effective identity
Check the application pool identity and the IIS authentication settings for this application. Classic ASP requests can run under different effective identities depending on anonymous authentication and impersonation configuration. Do not assume every file write runs as the application pool virtual account.
For an application that actually writes under an application pool identity, the account name uses the IIS AppPool\PoolName format. If a test still fails, examine the effective identity and ACL inheritance rather than repeatedly granting broader groups. A service identity that can write locally may still lack access to a network share; that also involves the share's own permission boundary.
Test a narrow disposable directory first
Ask the server operator to create a dedicated test directory and grant the required operations to the confirmed identity. A typical upload lifecycle needs to create and write temporary files; cleanup and promotion may also require deletion or movement. The exact rights depend on whether source and destination share a volume and on the storage implementation.
- Confirm the configured directory exists.
- Try a tiny synthetic upload before testing a large file.
- Verify save, read, rename or move, and cleanup using the application's actual identity.
- Repeat after an application pool recycle.
- Remove temporary diagnostic output that reveals server paths.
Do not grant Everyone full control or add write permission to the entire site just because one folder failed. Likewise, do not change the application's identity merely to make a test pass without understanding what other resources that account can reach.
Distinguish permission errors from rejected requests
If IIS rejects the request before ASP runs, changing folder permissions will not help. Inspect the HTTP status and IIS substatus. A request-size rejection belongs to request filtering or ASP limits; an unmapped ASP handler belongs to installation or handler configuration. A successful upload followed by a failed final save points to a later storage step.
Keep detailed Windows and filesystem errors in server diagnostics, associated with a request identifier. Return a useful failure message to the browser without exposing absolute paths or account credentials. Test the same request locally and on the deployed application rather than assuming a development-machine ACL matches the server.
Apply this to ASPUploader
Set the uploader's temporary directory and your application's final destination according to the documented deployment setup. After a transfer completes, confirm that the expected file exists before displaying a permanent attachment. The transfer UI does not grant filesystem permission and does not choose a safe business storage policy for you.
Common questions
Does Server.MapPath create the directory?
No. It resolves a path. The directory must exist or be created by authorized application code or deployment tooling.
Should I use the application pool account or IUSR?
Use the identity that actually performs the write under your IIS authentication configuration. Do not guess from the pool name alone.
Related guides and working examples
Official references
Examples describe the stated framework and application workflow. Check your installed component version and hosting configuration before adapting them.