使用C#设置文件夹权限异常：已添加NETWORK SERVICE但未配置权限

Got it, let's sort out that permission problem with your C# web app update tool. You’ve already added the NETWORK SERVICE account to the folder’s security list, but the missing piece is actually assigning specific permissions to it. Here’s a straightforward way to fix this:

Adding the account to the access control list (ACL) is only half the battle—you need to explicitly define what permissions that account should have. Below is a complete, reusable method that handles both adding the identity and configuring the required rights:

using System.IO;
using System.Security.AccessControl;
using System.Security.Principal;

public static void ConfigureNetworkServicePermissions(string targetFolder, FileSystemRights requiredRights)
{
    // Get the current security settings of the target folder
    DirectoryInfo folderInfo = new DirectoryInfo(targetFolder);
    DirectorySecurity folderSecurity = folderInfo.GetAccessControl();

    // Reference the NETWORK SERVICE account
    IdentityReference networkServiceAccount = new NTAccount("NETWORK SERVICE");

    // Create a rule that defines the permissions, inheritance, and propagation
    FileSystemAccessRule permissionRule = new FileSystemAccessRule(
        networkServiceAccount,
        requiredRights,
        InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
        PropagationFlags.None,
        AccessControlType.Allow);

    // Add the new permission rule to the folder's security settings
    folderSecurity.AddAccessRule(permissionRule);

    // Apply the updated security settings back to the folder
    folderInfo.SetAccessControl(folderSecurity);
}

How to use this method #

Call it right after your archive/deployment steps, specifying the folder and the permissions your web app needs. For example, to grant read, execute, and folder listing access (common for most web apps):

ConfigureNetworkServicePermissions(@"C:\YourWebAppRoot", 
    FileSystemRights.ReadAndExecute | FileSystemRights.ListDirectory);

Key notes to avoid pitfalls #

• Inheritance: The ContainerInherit | ObjectInherit flags ensure permissions apply to all subfolders and files within the target directory—critical for web apps with nested content.
• Permission selection: Pick FileSystemRights values that match your app's needs. Avoid overgranting (like FullControl) unless absolutely necessary. Common options include Write (for upload folders) or Modify (for apps that need to update files).
• Elevated rights: Your tool must run with administrative privileges to modify folder permissions—add a check or manifest to enforce this, otherwise the method will throw an exception.

Why your current setup failed #

When you only add the account to the ACL without an associated access rule, Windows knows the account exists in the security list but has no instructions on what it can do. The AddAccessRule step is what links the NETWORK SERVICE identity to concrete permissions, making the entry functional.

内容的提问来源于stack exchange，提问作者Russell Walters