---
title: Windows IIS Application Pool Strategy
slug: kronpam-reference-guide-3-9-0/windows-iis-application-pool-strategy
docTags: 
createdAt: 2024-12-03T08:15:19.361Z
---

This section explains how to change the user-defined password for IIS Anonymous Authentication using Application Configuration and Trigger.

WinRM service must be installed on target devices.

Users must have configured IIS information for this option in a similar manner to the example below.

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/64RJ3rFhvfc2xJHVv4I2-_image.png" size="84" width="943" height="619" position="center" caption="IIS Application Pools Definition Screen" darkWidth="943" darkHeight="619" showCaption="true"}

Select the Application Pool for password change, and assign the user value.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Il4P4obZ_hKLzvmlVIKiu_image.png "IIS Application Pools Assign User Screen")

An Application Trigger Config needs to be made for this option.

1. Navigate to the **Secrets > Configurations > Application Configuration.**
2. Click the **+Add **button.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Q322QlrKysvQt6b_AFl4u_image.png "Application Configuration Definition Screen")

-  Enter the parameters. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/g7uvCG4TF7FYZTTDGxUx6_image.png "Application Configuration Definition Screen")

- Select **Windows IIS Application Pool** as the Strategy.
- Enter the WinRM port, through which the Windows IIS Application Pool runs.
- Select NTLM as the WinRM Authentication Method and click the **Save** button.
- Navigate to  **Secrets > Application Management** screen.
- Click the +**Add** button.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/BgGYoXuHVz3NVzaZupbUI_image.png "Application Management – Application Trigger Definition Screen")

With this definition, when the Vault account's password is changed, reset, or updated, a trigger is generated for Windows IIS Application Pool to automatically change the password on the target device.

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/xTYg9Rf3SF4Ad4SnYkwSQ_image.png" size="72" width="495" height="580" position="center" darkWidth="495" darkHeight="580" showCaption="false"}

The IIS Application Pool Name field needs to be entered from IIS.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Y-FdLCxePcpBWKAVlTQ2u_image.png "IIS Application Pools Name Show Screen")

1. For the IIS changes to be active, a Restart operation may be required on the IIS side. If you want to restart, set the **Restart-Service After Command Run** switch box to **On**. **But remember that all users will close their sessions at this time.**
2. Select the Vault Account defined in Password Vault and whose password we want to change.
3. If the user defined for Password Vault is an authorized user to make changes on IIS, the **Use Authentication User **switch box can remain off. If it is not an authorized user, the **Name and Password **information of the** Administrator user** need to be entered in the relevant fields.
4. The Target Type value should be selected as **Single Device**.
5. The device information where IIS is installed and the device to be modified must be selected.
6. If all field values are entered, Click the **Save** button and the configuration will be completed.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Nqftb4hF0XCg0drk5K_We_image.png "Application Trigger Definition Screen for IIS Application Pool Strategy")

- Open the Vault screen, and select the Vault account.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Qv1S819escFVtiy-zhTLD_image.png "Vault Screen")

- Click the **Action** button and a new popup will be shown.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/7iD7qZGfOUGczfXvqdA6__image.png)

- If **Reset Password** or **Update Password** is clicked, Kron PAM will change the password information from Windows Local User or Active Directory for the selected account. Additionally, a new Application Trigger record will be created by Kron PAM to change the password on the IIS server.
- Open the Application Management page, and list that record by clicking on the application trigger name. To start this record and change the password on the IIS site immediately, click **Run.** Otherwise, the Application Trigger job will automatically run this record according to the defined period.
- When sending the updated password to the IIS Application Pool, the password data is transmitted in an encrypted format. The password is not visible in plain text on the server.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/ZANzCa8dstZRy3s-n2S5q_image.png)