Understand the Common Causes
IIS validates a custom identity against the local security authority, not just the domain controller. If the workstation is not a member of the target domain, the password is encrypted locally and the domain cannot be reached, resulting in the "specified password is invalid" dialog. Other frequent blockers are account lockout, password‑policy mismatch, or the account lacking the "Log on as a batch job" right.
Even though Remote Desktop and runas /netonly succeed, those tools only need network authentication, while IIS needs to create a local security token for the process.
Verify the Account Outside IIS
Before touching IIS, confirm that the machine can resolve the domain and that the account is not locked.
```cmd # Check domain connectivity nltest /dsgetdc:yourdomain.com
# Validate credentials without creating a token runas /user:DOMAIN\User cmd ```
If these commands succeed, the problem is specific to the way IIS creates the service account token.
Grant the Required User Rights
IIS creates a worker process that runs as a service. The account must have the "Log on as a batch job" and "Log on as a service" rights. Add them via the Local Security Policy snap‑in or with secedit:
```cmd secedit /export /cfg C:\temp\secpol.cfg # Edit secpol.cfg, add DOMAIN\User to SeBatchLogonRight and SeServiceLogonRight secedit /import /cfg C:\temp\secpol.cfg /db C:\temp\secpol.sdb ```
After updating the rights, restart the computer so the policy takes effect.
Configure the Application Pool Using PowerShell
When the workstation is a member of the domain, use PowerShell to avoid UI glitches that can misinterpret the password.
```powershell Import-Module WebAdministration $pool = 'MyAppPool' $domainUser = 'DOMAIN\User' $pwd = ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force Set-ItemProperty IIS:\AppPools\$pool -Name processModel.identityType -Value SpecificUser Set-ItemProperty IIS:\AppPools\$pool -Name processModel.userName -Value $domainUser Set-ItemProperty IIS:\AppPools\$pool -Name processModel.password -Value $pwd ```
If the command returns no error, the pool now runs under the custom account. Verify with IIS Manager → Advanced Settings → Identity.
When the Machine Isn’t Joined to the Domain
If joining the domain is not possible, switch to the built‑in "ApplicationPoolIdentity" and use delegation (Kerberos constrained delegation) to access resources on the remote domain. Alternatively, create a local account that mirrors the domain credentials and grant it the same rights, but this approach is less secure and should be a last resort.
Takeaway: IIS rejects a valid domain account when the local machine cannot create a proper security token; ensure domain membership, required user rights, and set the identity via PowerShell.
People also ask
Why does Remote Desktop work but IIS still says the password is invalid?
Remote Desktop only authenticates over the network, while IIS must generate a local logon token, which fails if the account lacks the necessary user rights or the machine isn’t domain‑joined.
Can I use a domain account on a workgroup computer?
No. IIS can only use domain accounts on computers that are members of that domain; otherwise you must rely on built‑in identities or local accounts.
Do I need to restart IIS after changing the pool identity?
Yes. After updating the identity, recycle the pool or restart the IIS service to apply the new token.
Inspired by a public discussion on Stack Overflow. This article is an original explanation for learners.