Grant Advanced Access Rights for Internet Information Server

Some HRPro functions require additional access to files, folders, or scheduled tasks. These may include database backup downloads, restore uploads, configuration updates, and Business Alert scheduling.

Certain functions in HRPro require Advanced Access Rights for the Internet Information Server (IIS). These include:

• Enabling Business Alert to work with Windows Task Manager to schedule tasks.

• Activating the Download button in Database Backup.

• Enabling the Upload and Restore button in Database Restore.

• Modifying HRPro.config when enabling SQL Server Password Encryption.

• Reading files from the hard disk.

1. Identify the application pool

1. Open IIS Manager.

2. Under Sites, select the HR Workspace application.

3. Click Basic Settings and note the application pool name.

4. Select Application Pools, select that pool, and click Advanced Settings.

5. Confirm that Identity is set to ApplicationPoolIdentity.

The Windows account for the pool is:

IIS AppPool\<ApplicationPoolName>

For example:

IIS AppPool\HRWorkspacePool

IIS allows you to grant folder permissions directly to this account.

See Configure IIS Application Pools and Folder Permissions for HRPro 

2. Grant the required permissions

Grant access only to the location used by the relevant function:

• Backup downloads: Grant Read on the folder containing the backup files.

• Restore uploads: Grant Write on the upload folder. Grant Modify only if HRPro must also replace or delete files.

• Other file operations: Grant Read for viewing files, or Modify where creating, updating, and deleting files is required.

• Configuration updates: If a function needs to update HRPro.config, grant the necessary write access for that operation, then restore read-only access if ongoing write access is not required.

Do not grant Modify or Full control to the entire application folder as a general workaround. Use permissions limited to the affected files or folders.

Add a folder permission

1. Right-click the required folder and select Properties.

2. Open Security > Edit > Add.

3. Under Locations, select the local server.

4. Enter IIS AppPool\<ApplicationPoolName>.

5. Click Check Names, then OK.

6. Select the required permissions and apply the changes.

7. Test the affected HRPro function.

3. Check SQL Server access

For database backup and restore operations, IIS and SQL Server need separate permissions.

The IIS account handles web uploads and downloads. The SQL Server service account needs access to the backup files used by the database engine. The SQL login must also have the required backup or restore permissions.

If a backup or restore fails, check which account and operation caused the error before changing permissions.

4. Business Alert scheduling

Business Alert uses Windows Task Scheduler. Use a dedicated Windows account with permission to create, update, and run Business Alert tasks. Configure the HR Workspace application pool and Business Alert to use this account, and grant it Log on as a batch job rights.

5. Temporarily Use LocalSystem for Troubleshooting

Do not use LocalSystem or an administrator account as a general fix for permission errors. These accounts grant excessive privileges. For temporary troubleshooting in a controlled test environment, you may use LocalSystem to check whether an issue is permission-related. Restore ApplicationPoolIdentity after testing and grant only the permissions required. Do not leave this setting enabled in production.

To temporarily change the application pool identity:

1. Open Internet Information Services (IIS) Manager

2. Select the HRPro Website for which you need to modify permissions

3. Go to Basic Settings and see which application pool you're using. Usually, it is named DefaultAppPool 

4. Go to Application Pools and find the application pool from #3

5. Right-click the application pool and select Advanced Settings...

6. Change the Identity from ApplicationPoolIdentity to LocalSystem.

7. Click OK to save, then test the affected function.

8. After testing, restore the identity to ApplicationPoolIdentity.