1. On the computer that is running Tableau Server, select Start > Control Panel > Administrative Tools > Local Security Policy.
2. In the Local Security Settings window, expand Local Policies, click User Rights Assignments, and then right-click Act as part of the operating system and select Properties.

   

3. In the Act as part of the operating system Properties window, click Add User or Group.
4. Type the <domain>\<username> for the Tableau Server Run As User account (for example: MYCOMPANY\tableau_server), and then click Check Names.
5. When the account resolves correctly, it is underlined. Click OK.
6. Click OK to close the Local Security Policy windows.

照上面的流程，可以讓 asp.net 提升權限為其他帳號，預設完全沒去修改的情況下，帳號是使用：

IIS APPPOOL\DefaultAppPool

建立本機使用者帳戶

更新日期: 2012年3月

適用於: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012

https://support.microsoft.com/en-us/help/306158/how-to-implement-impersonation-in-an-asp-net-application

MS 寫的不太貼心：

Impersonate the IIS Authenticated Account or User

To impersonate the Microsoft Internet Information Services (IIS) authenticating user on every request for every page in an ASP.NET application, you must include an <identity> tag in the Web.config file of this application and set the impersonate attribute to true. For example:

<identity impersonate="true" />

back to the top

Impersonate a Specific User for All the Requests of an ASP.NET Application

To impersonate a specific user for all the requests on all pages of an ASP.NET application, you can specify the userName and password attributes in the <identity> tag of the Web.config file for that application. For example:

<identity impersonate="true" userName="accountname" password="password" />

Note The identity of the process that impersonates a specific user on a thread must have the “Act as part of the operating system” privilege. By default, the Aspnet_wp.exe process runs under a computer account named ASPNET. However, this account does not have the required privileges to impersonate a specific user. You receive an error message if you try to impersonate a specific user. This information applies only to the .NET Framework 1.0. This privilege is not required for the .NET Framework 1.1.

To work around this problem, use one of the following methods:

• Grant the “Act as part of the operating system” privilege to the ASPNET account (the least privileged account).Note Although you can use this method to work around the problem, Microsoft does not recommend this method.
• Change the account that the Aspnet_wp.exe process runs under to the System account in the <processModel> configuration section of the Machine.config file.

正確用法：

The identity section goes under the system.web section:

<system.web>
  <authentication mode="Windows"/>
  <identity impersonate="true" userName="foo" password="bar"/>
</system.web>

相關文章：

Enable Run As User to Act as the Operating System
https://stackoverflow.max-everyday.com/2018/02/enable-run-as-user-to-act-as-the-operating-system/

附註：在impersonate為其他帳號時，需要開啟 asp.net 的 temp folder 的寫入權限給該 user account, 不然會產生錯誤訊息。

附註： 如果遇到這一個 Exception 在 copy file 時：

System.IO.IOException: The user name or password is incorrect.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite, Boolean checkHost)

請檢查 impersonate 相關的帳號/密碼設定，或寫法是否正確。

HTTP Error 404.3 – Not Found The page you are requesting cannot be served because of the extension configuration. If the page is a script, add a handler. If the file should be downloaded, add a MIME map.

解法：

go to control panel or use search  -> ‘Turn Windows feature on or off‘ ->

I just went to ‘Add roles and features’ and in the Features part I checked ‘HTTP activation‘ on ‘.Net Framework 4.5 Features‘ -> ‘WCF Services‘.

有錯誤的設定值：

<system.webServer>
<modules runAllManagedModulesForAllRequests=”true”/>
</system.webServer>

錯誤原因：

This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault=”Deny”), or set explicitly by a location tag with overrideMode=”Deny” or the legacy allowOverride=”false”

google 了很久，結果最後解法是透過：

I had the same problem. Don’t remember where I found it on the web, but here is what I did:

• Click “Start button”
• in the search box, enter “Turn windows features on or off”
• in the features window, Click: “Internet Information Services”
• Click: “World Wide Web Services”
• Click: “Application Development Features”
• Check (enable) the features. I checked all but CGI.

截圖：

原來預設不會安裝這一些，只要全裝上去就可以跑了。