Hi,
During my research I found every Server has a kind of Single Active Directory to administer the Local accounts, local users, permissions as the way Active Directory does, but the perimeter is local, that means your user in a specific machine not exist into another machine (having this user is local).Taking advantage of this it is possible to create a mirrored account.
what you have to do is as follow: The WebServer into the DMZ has already created the ASPNET local account which has permissions to execute the .NetFramework, so you have to edit the machine.config file located at C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CONFIG\
inside that file look for
and change it to
That an impersonation process where all the request from the WebServer to the SQL will be granted to ASPNET user.
After that create the local account ASPNET in the SQL Server, this accounts has to have the same attributes the one on WebServer does, this means password should be the same in both servers.
after that go to SQL server, Security Section and give permissions to the local account ASPNET to the databases you desired and the permissions you desired.
Once you have created the ASPNET local account on the SQL Server and the permissions are set for that user on the SQL. You need to edit the local policies of the SQL server.
To do that execute secpol.msc located at system32 folder, once the Local Security Settings is already open locate the Local Policies and expand it, then locate User Rigths Assigment. At the rigth pane locate these five entries and add ASPNET user to those entries.
-Bypass traverse checking
-Lock pages in memory
-Log on as a batch job
-Log on as a service
-Replace a process level token
And that's it. If you have any question you can find me at axel.calderon@gmail.com
