msdeploy and AppPool running under domain user

Question

I'm using the CompanyApp.deploy.cmd to for remote deployment of a web application package (/t:Package). The AppPool runs under a domain user (because of kerberos), not under Network Service Account.

I am using a local Administrator for deployment.

When building on our CI server I call:

CompanyApp.deploy.cmd
  /Y
  /M:IP
  /U:Administrator
  /P:******
  -enableRule:DoNotDeleteRule

following error occurs:

27-Mrz-2013 14:41:28    SetParameters from:
27-Mrz-2013 14:41:28    "C:\b\SH-SDS09-DEP2\CompanyApp\CompanyApp.SetParameters.xml"
27-Mrz-2013 14:41:28    You can change IIS Application Name, Physical path, connectionString
27-Mrz-2013 14:41:28    or other deploy parameters in the above file.
27-Mrz-2013 14:41:28    -------------------------------------------------------
27-Mrz-2013 14:41:28     Start executing msdeploy.exe
27-Mrz-2013 14:41:28    -------------------------------------------------------
27-Mrz-2013 14:41:28     "C:\Program Files (x86)\IIS\Microsoft Web Deploy V3\msdeploy.exe" -source:package='C:\b\SH-SDS09-DEP2\CompanyApp\CompanyApp.zip' -dest:auto,computerName="IP",userName="Administrator",password="********",includeAcls="False" -verb:sync -disableLink:AppPoolExtension -disableLink:ContentExtension -disableLink:CertificateExtension -setParamFile:"C:\b\SH-SDS09-DEP2\CompanyApp\CompanyApp.SetParameters.xml"  -enableRule:DoNotDeleteRule -setParam:...
27-Mrz-2013 14:41:29    Info: Using ID '475e8a8f-94a4-4cda-8e4c-a281bbc75145' for connections to the remote server.
27-Mrz-2013 14:41:29    Info: Adding ACL's for path (Default Web Site/CompanyApp)
27-Mrz-2013 14:41:29    Error: (3/27/2013 2:41:29 PM) An error occurred when the request was processed on the remote computer.
27-Mrz-2013 14:41:29    Error: The account 'COMPANYDOMAIN\service_user' does not appear to be valid. The account was obtained from this location: 'system.applicationHost/applicationPools/CompanyAppPool'.
27-Mrz-2013 14:41:29    Error: Some or all identity references could not be translated.
27-Mrz-2013 14:41:29    Error count: 1.

When the AppPool runs under Network Service Account remote deployment is successful.

Which constellation leads to successful deployment here?

Answer 1

The credential the service is running as does not have write permissions to the applicaitonhost.config. You should give this user write permissions to \inetsrv\config