Cannot read configuration file due to insufficient permissions
If a Nodinite Core Service web site returns "Cannot read configuration file due to insufficient permissions", its IIS application pool identity can't read the IIS configuration files on the server. This guide explains why and how to fix it.
✅ Step-by-step solution for IIS application pool permission issues
✅ Works for every Core Service web site, with the Log API as the typical example
✅ Keeps the service identity least-privileged
Why This Happens
On Windows Server, every Nodinite Core Service runs as its own IIS web site under the service identity you set in the Portal (Auth step and Servers step). Some services read IIS settings at runtime, for example to report their own application pool identity, and that read goes through redirection.config in %windir%\system32\inetsrv\config. When the identity isn't a local administrator and isn't in the IIS_IUSRS group, Windows denies the read.
Note
This error only occurs on Windows Server installations hosted in IIS. Container hosting doesn't use the IIS configuration files.
The Problem
The Log API error page looks like this example (the path in the first line depends on the version and the web site):
Server Error in '/ENVIRONMENTNAME/LogAPI' Application.
Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions
Exception Details: System.UnauthorizedAccessException: Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions
Stack Trace:
[UnauthorizedAccessException: Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions]
Microsoft.Web.Administration.Interop.IAppHostAdminManager.GetAdminSection(String bstrSectionName, String bstrPath) +0
Microsoft.Web.Administration.ServerManager.ApplicationPoolsSectionCreator() +74
Nodinite.LogApiHost.Controllers.InformationController.GetAppPoolIdentity(String applicationPoolName) +86
The Solution
The application pool identity does not have Read rights on %windir%\system32\inetsrv\config. Use one of these fixes, then recycle the application pool of the affected web site (for example the Log API):
- Add the service identity to the local IIS_IUSRS group and give that group Read rights on the folder that holds
redirection.config; see IIS_IUSRS group membership. This is the recommended fix. - Or grant the service identity itself Read rights on
%windir%\system32\inetsrv\config.
For a gMSA identity, include the trailing `
Cannot read configuration file due to insufficient permissions
If a Nodinite Core Service web site returns "Cannot read configuration file due to insufficient permissions", its IIS application pool identity can't read the IIS configuration files on the server. This guide explains why and how to fix it.
✅ Step-by-step solution for IIS application pool permission issues
✅ Works for every Core Service web site, with the Log API as the typical example
✅ Keeps the service identity least-privileged
Why This Happens
On Windows Server, every Nodinite Core Service runs as its own IIS web site under the service identity you set in the Portal (Auth step and Servers step). Some services read IIS settings at runtime, for example to report their own application pool identity, and that read goes through redirection.config in %windir%\system32\inetsrv\config. When the identity isn't a local administrator and isn't in the IIS_IUSRS group, Windows denies the read.
Note
This error only occurs on Windows Server installations hosted in IIS. Container hosting doesn't use the IIS configuration files.
The Problem
The Log API error page looks like this example (the path in the first line depends on the version and the web site):
Server Error in '/ENVIRONMENTNAME/LogAPI' Application.
Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions
Exception Details: System.UnauthorizedAccessException: Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions
Stack Trace:
[UnauthorizedAccessException: Filename: redirection.config
Error: Cannot read configuration file due to insufficient permissions]
Microsoft.Web.Administration.Interop.IAppHostAdminManager.GetAdminSection(String bstrSectionName, String bstrPath) +0
Microsoft.Web.Administration.ServerManager.ApplicationPoolsSectionCreator() +74
Nodinite.LogApiHost.Controllers.InformationController.GetAppPoolIdentity(String applicationPoolName) +86
The Solution
The application pool identity does not have Read rights on %windir%\system32\inetsrv\config. Use one of these fixes, then recycle the application pool of the affected web site (for example the Log API):
- Add the service identity to the local IIS_IUSRS group and give that group Read rights on the folder that holds
redirection.config; see IIS_IUSRS group membership. This is the recommended fix. - Or grant the service identity itself Read rights on
%windir%\system32\inetsrv\config.
in the account name when you grant the rights. The Log API prerequisites, Web API prerequisites, and Web Client prerequisites list the same Read right for their service identities.