Updating Performance Counters from ASP.NET

While there are a number of quite useful articles about how to access and increment PerformanceCounters through the .NET Framework (the <a href="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfSystemDiagnosticsPerformanceCounterClassTopic.asp">PerformanceCounter class description</a> on MSDN and <a href-"http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vbcon/html/vbtskcreatingcustomperformancecounters.asp">Creating Custom Performance Counters</a>, also on MSDN to name two), the actual deployment of a web service (or any ASP.NET application, as it turns out) is not so thoroughly covered. 
The biggest problem surrounding the process of moving an ASP.NET application that updates performance counters into a production environment is permissions.  By default, in order to increment a performance counter, the user needs to have Administrator or Power User rights.  This means that a typical ASP.NET application will not be able to update any performance counter.  For completeness, the event log entry that appear as a result of the lack of permissions is as follows:
 
Event ID:  1000
Source: Perflib
Access to performance data was denied to ASPNET as attempted from C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
 
Also, on the actual call to increment the PerformanceCounter, the following exception is thrown:
 
System.ComponentModel.Win32Exception: Access is denied
 
with the stack trace pointing to the GetData method in the PerformanceMonitor class.
 
There are, of course, a couple of possible solutions.
1. You could change the processModel tag in machine.config to so that the ASPNET user runs as System, but that leaves a security hole wide enough to drive an 18-wheeler through.  Which is another way of saying “Don't do this!!!!!”.
2.  You could run ASP.NET in impersonation mode.  Now the ASP.NET process will take on the identity of the person making the request.  If that person has Administrator or Power User access, all with be fine with respect to incrementing performance counters.  But if not, the same problem exists.
Fortunately, given these alternatives, it turns out that the permission set required to update performance counters is much smaller than running as an Administrator or Power User.  In the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib, set the Access Control List so that the necessary user has Full Control. In our original example, the ASPNET user would be granted Full Control, but access can be granted to anyone who needs to update a performance counter.