Set up Express Server to use network drives (Windows)

Explanation:

The Express Server installer uses the default NetworkService user in many places to run its services and processes. This works well for most organizations. However the NetworkService user generally does not have access to network drives. Some network administrators also limit the NetworkService user's permission level which can cause problems running the server. The solution is to change the app pool identity and the Tomcat service log on to a domain user that has special security permissions instead.

Solution:

You need to find or create a domain user to use for this task. Grant the domain user access to your network drives and to certain folders on the local computer running Express Server. You can do this using a few different methods, but here is one simple process:

Grant permission to the network drives:

1. Use file explorer to locate the network drive where your imagery is stored
2. Right-click on the drive name and go to Properties
3. Click the security tab and add your domain user with read permissions
4. Click OK on every dialogue box

Grant permission to the local folders:

5. On the local computer running Express Server use file explorer to locate the drive where Express Server is installed
6. Right-click on the drive where Express Server is installed and select Properties
7. Click the security tab and add your domain user with read permissions
8. Click OK on the dialogue box
9. Now browse to the ImageServer directory of wherever Express Server is stored, which by default is C:\Program Files\LizardTech\Express Server\ImageServer
10. Right-click on the etc folder and go to Properties
11. Click on the security tab and click Edit
12. Select your domain user and select the Full Control checkbox under Allow
13. Click OK on each dialogue box
14. Repeat this process for the var folder within the same directory

Ultimately you want this domain user to have read permission on the C: drive and full permission on the etc and var folders.

The Tomcat service login, the app pool identity, and the website's anonymous user must all be changed:

Tomcat Service:

1. Open the Services panel
2. Scroll down to the LizardTech Express Server Tomcat Service
3. Right-click on this service and select Properties
4. Click the Log On tab of the window that appears
5. Use the Browse picker to find your domain user account
6. Enter the password for the domain user and click OK on the window
7. Stop and restart the LizardTech Express Server Tomcat Service

App pool identity:

8. Open IIS
9. Browse to the Application Pool and find the LTESAppPool option.
10. Right-click on the LTESAppPool option and select Advanced Settings...
11. Scroll down to Process Model and select Identity. Click the three small dots on the right side to open it.
12. Select Custom Account and enter the username and password for your domain user
13. Click OK on every dialogue box
14. Browse to the website where Express Server is running (usually, but not always, Default Website)
15. Drill down into Lizardtech and select iserv
16. Double-click on the Authentication icon
17. Find the Anonymous Authentication entry and select Edit...
18. Select the radio button for "Application pool identity"
19. Click OK on the dialogue box
20. Reset IIS

Now you can add and use network catalogs within Express Server.  You can verify these changes were successful by checking the running processes from all users in the task manager.  If the user name associated with w3wp.exe (the app pool) and tomcat8.exe is your domain user then everything is set up correctly.