IIS WordPress error 500 on uploaded files

On Windows with IIS, files uploaded through WordPress sometimes cannot be served and return an HTTP 500 error, even though the upload succeeded.

The cause

PHP first uploads the document to a temporary directory, by default C:\Windows\Temp, and then moves it from there to the actual /wp-content/uploads/ subdirectory.

Because IIS does not have any permissions on C:\Windows\Temp, when the file is uploaded there and then moved by PHP, it inherits no permissions. So when IIS tries to serve that file from the uploads directory it throws a 500 error, which is actually a permissions error.

The solution

On the C:\Windows\Temp folder, grant Modify permissions to both the IUSR and the IIS_IUSRS accounts. From now on, when PHP moves uploaded files to the correct directory, they will have the right permissions and can be served.

Note 1: if you already have uploaded files and are getting the dreaded broken images issue, go to the /wp-content/uploads/ directory and update the permissions to add access for both accounts noted above.

Note 2: as with any change to the Windows defaults, you do this at your own risk. If you prefer not to change the permissions of C:\Windows\Temp, move the PHP temp folder elsewhere (upload_tmp_dir in php.ini) and grant those two accounts access to the new folder.