Guide to Getting PHP 5 to work with IIS with Custom Identity

When you want PHP running in Microsoft Internet Information Services (IIS) to be able to read/write files on a Windows network share, you could run into a myriad of errors and problems. Hopefully this article will help you get everything working smoothly.

Here what we want is to have IIS run as a Domain user who has the proper access to the network share.

After you have installed PHP (in ISAPI mode), go to the IIS Manager, Application Pools, right-click on DefaultAppPool (or the name of your application pool), and select Properties.

Go to the Identity tab and type in the User name and Password for the Domain user. Don't forget to prefix the username with the Domain. For instance (and for our example's sake): MY_DOMAINmy-user
Click OK and you will be asked to confirm the password again.

Now you'll want to make sure that you go to the server that has the target directory share and make sure all the permissions are set so that that MY_DOMAIN\my-user has the proper read or read/write permissions to that share.

Then back on the IIS server, go to Administrative Tools, Computer Management, expand Local Users and Groups, go to Groups, and double-click on IIS_WPG (IIS Worker Process Group). You must add MY_DOMAIN\my-user to the group or else you may end up with the "Service Unavailable" message when you try to load the website.

Next go to Administrative Tools, Local Policies, and User Rights Assignment. Add MY_DOMAIN\my-user to the following policies of "Access this computer from the network", "Act as part of the operating system", and "Log on as a service".

Now go to the Properties of your website ("Default Web Site"), go to the Directory Security tab, and click on the Edit button for "Authentication and access control". If you have enabled anonymous access, make sure that the user name is set to MY_DOMAIN\my-user and the password is inputted correctly.

Restart IIS and voila, everything should work. If not ensure that you have checked the Event Viewer on the destination server and see if the error messages there give you any clue as to why it's not working. If you see Microsoft Authentication Security Account Logon Failure, then it's an issue with the user name and password specified there.

In your PHP script make sure that you escape backslashes for the network share you're trying to get to. For instance if you're trying to do a "opendir" on "\\my_server\my_files", you would do:

$dh = opendir("\\my_server\my_files");

If you get PHP undefined function errors such as:

Fatal error: Call to undefined function mysql_connect() in C:\Inetpub\wwwroot\your_script.php

Then you must make sure that you've enabled the module (in this case extension=php_mysql.dll) in php.ini. If you did, it could well be that PHP is not reading the php.ini for some reason. You can make sure by looking at the output of php_info() and look for "Loaded Configuration File". If it says "(none)", then there's a problem. Make sure that "MY_DOMAIN\my-user" (in our example) has read permissions to the php.ini file AND the directory in which it resides- whether it be C:\PHP or C:\Windows.

If you have trouble executing commands using exec(), passthru(), etc, and the script seems to hang, make sure you have given the proper permissions to cmd.exe. So make sure that c:\windows, c:\windows\system32, and cmd.exe all can be read and executed by, in our example, MY_DOMAIN\my-user.

Good luck and I hope this guide helps. These instructions could work for other PHP and Microsoft Internet Information Server (IIS) versions as well, though I used PHP 5.2 and IIS 6.