The “Access is denied” error when running wkhtmltopdf.exe on Windows

Detailed Steps to Fix the “Access is Denied” Error

1. Ensure Correct Permissions on wkhtmltopdf.exe

• Grant Permissions to the User Running the Web Server: The IIS user (typically IUSR, IIS_IUSRS, or a custom user) needs to have Read & Execute permissions for wkhtmltopdf.exe.
  • Steps:
    1. Navigate to C:\Program Files\wkhtmltopdf\bin\.
    2. Right-click wkhtmltopdf.exe and select Properties.
    3. Go to the Security tab.
    4. Click Edit and ensure that the IIS user (e.g., IUSR or IIS_IUSRS) has Read & Execute permissions.
    5. If not, click Add, search for the user, and assign the permissions.
  Note: You might also need to grant permission to the NETWORK SERVICE account or the user under which your IIS Application Pool is running.

2. Check Folder Permissions for the Output Directory

• The directory where wkhtmltopdf.exe is trying to write the generated PDF also needs to be writable by the IIS user.
  • Steps:
    1. Locate the directory where the PDF file will be saved.
    2. Right-click on the folder, select Properties, and go to the Security tab.
    3. Ensure that the IIS user (e.g., IUSR, IIS_IUSRS, or the application pool identity) has Write and Modify permissions.

3. Test the Command Manually from Command Prompt

To rule out broader permission issues, test if the command works when run manually:

• Steps:
  1. Open Command Prompt as Administrator (right-click the Command Prompt and select Run as Administrator).
  2. Try running the command directly:

"C:\Program Files\wkhtmltopdf\bin\wkhtmltopdf.exe" https://www.google.com C:\path\to\output\file.pdf

• If the command runs successfully as Administrator, the issue is likely related to IIS permissions or the application pool identity.

4. Check IIS Application Pool Identity

IIS application pools typically run under low-privileged users (like ApplicationPoolIdentity or IUSR), which may lack the necessary permissions to execute wkhtmltopdf.exe.

• Steps to Change IIS Application Pool Identity:
  1. Open IIS Manager.
  2. Click on Application Pools.
  3. Right-click your application pool and select Advanced Settings.
  4. Under the Process Model section, change the Identity to a more privileged account (such as LocalSystem for testing, or configure a custom user account with appropriate permissions).
  Note: Running under LocalSystem should be done cautiously as it has broad system access. For production, consider creating a custom service account with the required permissions.

5. Use Procmon (Process Monitor) to Debug the “Access Denied” Error

If you’re still unable to determine where the permissions issue is occurring, you can use Procmon (a free tool from Sysinternals/Microsoft) to track down the specific file or folder that’s causing the “Access Denied” error.

• Steps:
  1. Download Procmon from the Sysinternals website.
  2. Run Procmon and filter by the wkhtmltopdf.exe process.
  3. Run the command again.
  4. Look for any “Access Denied” entries in the Procmon output, which should show you exactly which file or folder the process is having trouble accessing.

6. Verify Path Quoting (Check if Path Contains Spaces)

Ensure that the command path to wkhtmltopdf.exe and the paths to the input/output files are properly quoted if they contain spaces. Incorrect path quoting can cause issues on Windows.

• Correct usage example:

"C:\Program Files\wkhtmltopdf\bin\wkhtmltopdf.exe" "https://example.com" "C:\path\to\output\file.pdf"

7. Ensure Windows is Not Blocking the Executable

Windows may block executables downloaded from the internet.

• Steps:
  1. Right-click wkhtmltopdf.exe in C:\Program Files\wkhtmltopdf\bin\.
  2. Select Properties.
  3. If you see an Unblock button at the bottom of the dialog, click it, then Apply.
  4. Test the command again.

8. Antivirus or Security Software Blocking Access

Some antivirus or security software might block access to the executable or prevent IIS from executing it.

• Check if any security software is blocking access, or temporarily disable it and test the command.

9. Check for Group Policies or UAC Issues

In corporate environments, group policies or User Account Control (UAC) settings might block certain executables from running, especially if they were installed outside of the standard program directories.

• Try disabling UAC temporarily for testing:
  • Open Control Panel → User Accounts → Change User Account Control settings → Set the slider to Never notify.

Summary of Steps:

1. Ensure appropriate permissions for wkhtmltopdf.exe and the output directory (Read & Execute for the IIS user).
2. Test the command manually in an elevated Command Prompt.
3. Check and change the IIS Application Pool identity to a more privileged account.
4. Use Procmon to track down the “Access Denied” issue.
5. Ensure path quoting is correct (especially if paths contain spaces).
6. Unblock the executable if Windows has blocked it.
7. Check for antivirus/security software blocking execution.
8. Temporarily disable UAC for testing.

By going through these steps, you should be able to pinpoint and resolve the “Access Denied” issue with wkhtmltopdf.exe. Let me know if you need further clarification or if the issue persists!

Execution Permission (Read & Execute)

The user running the web server (typically IUSR, IIS_IUSRS, or the application pool identity) must have Read & Execute permissions for wkhtmltopdf.exe to run the executable. This allows the server to:

• Access the wkhtmltopdf.exe file.
• Execute the command.

Permission Setting:

• Navigate to the folder where wkhtmltopdf.exe is located (e.g., C:\Program Files\wkhtmltopdf\bin\).
• Right-click on wkhtmltopdf.exe → Properties → Security tab.
• Ensure the IIS user (like IUSR, IIS_IUSRS, or a custom user) has Read & Execute permission.
• To grant the permissions:
  1. Click Edit under the Security tab.
  2. Add the relevant user (IUSR, IIS_IUSRS, or application pool identity).
  3. Check the Read & Execute box, and apply the changes.

2. Read Permissions for Input Files/URLs

If wkhtmltopdf is converting an HTML file or reading from a URL, it needs Read access to the input file or the ability to fetch resources from the URL (if the server is behind a firewall or has restricted internet access, it may be blocked from fetching URLs).

Ensure that:

• Any local HTML files that wkhtmltopdf needs to convert are accessible to the IIS user (or whoever is running wkhtmltopdf).
• The user running the application has access to the internet if converting online pages.

3. Write Permissions for Output Directory

The directory where wkhtmltopdf writes the output PDF files must be writable by the web server user. Without this, the program will fail to save the generated PDF files, even if the command runs successfully.

Permission Setting:

• Navigate to the folder where the PDF output will be written.
• Right-click on the folder → Properties → Security tab.
• Ensure that the IIS user (e.g., IUSR, IIS_IUSRS, or the application pool identity) has Write and Modify permissions for this directory.
• To grant the permissions:
  1. Click Edit under the Security tab.
  2. Add the relevant user and check the Write and Modify permissions.
  3. Apply the changes.

4. Access to Temporary Folders

In some cases, wkhtmltopdf might use temporary files during the conversion process. Ensure that the IIS user or the user running the application has Write permissions to system temporary folders:

• On Windows, this is usually the %TEMP% or %TMP% folder.
• Verify that the application pool identity or user account has access to these temporary directories.

5. Administrative Privileges (If Necessary)

In rare cases, if your wkhtmltopdf.exe setup involves system-level interactions (such as using restricted system fonts or directories), the application may require elevated privileges (such as Administrator).

However, this is uncommon for standard use cases, and you should first try solving any permission issues with standard user accounts like IUSR or a custom service account before resorting to running as an Administrator.

Troubleshooting Permissions Issues:

• Procmon (Process Monitor): If you’re still facing issues after adjusting permissions, you can use Process Monitor to trace what files or resources wkhtmltopdf.exe is trying to access and where it might be encountering “Access Denied” errors.

Summary of Permissions Needed:

• Read & Execute permission on wkhtmltopdf.exe for the user running the process (e.g., IUSR, IIS_IUSRS).
• Read permission for any input files or URLs (ensure the web server can access the HTML or URL).
• Write permission for the output directory where PDFs will be saved.
• Write permission for temporary directories (%TEMP% folder).
• Administrative privileges only if absolutely required by your setup (try standard permissions first).

Make sure these permissions are properly configured, and wkhtmltopdf.exe should work without throwing “Access is denied” errors.