« Previous Next »

• 06-12-2009, 7:36 PM

  carewithl Joined on 06-12-2009, 11:29 PM Posts 3

  IIS worker process is denied an access, even though I've grant it access permissions Reply Contact   Normal 0 false false false MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} hi   If I’m not mistaken, then by default all application pools in IIS 7 run under Network Service account. So I created asp.net application and gave Network Service account access permission to files in that application directory. But when I tried to request a page, I received access denied  message ( 401.3 )   I then granted access to IIS_IUSRS group, but I still got access denied message <-- Here I’m assuming network service account is by default member of this group?   a) Doesn’t IIS 7.0 automatically add the account under which worker process executes to the IIS_IUSRS group? If yes, then why do I get access denied message?     b) I gather IIS 7.0 worker process can run under any account ( and also doesn’t have to be a member of IIS_IUSRS group ), as long as we grant that account access to the resources which it will need to access?     Thank you

• 06-13-2009, 3:12 AM

  In reply to

  vinesh_kumar Joined on 06-08-2009, 6:22 AM Posts 4	Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact In IIS 7.0 by default, Network Service account wont be vailable under IIS_IUSRS group. we have to add it. If u do this, u can solve this error.  If u still get error, refer the event log viewer for detailed error message.

• 06-13-2009, 3:14 AM

  In reply to

  vinesh_kumar Joined on 06-08-2009, 6:22 AM Posts 4	Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact   For more details about the Users and Groups in IIS 7. refer this link. http://learn.iis.net/page.aspx/140/understanding-the-built-in-user-and-group-accounts-in-iis-7/

• 06-15-2009, 5:11 PM

  In reply to

  carewithl Joined on 06-12-2009, 11:29 PM Posts 3

  Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact vinesh_kumar: In IIS 7.0 by default, Network Service account wont be vailable under IIS_IUSRS group. we have to add it. If u do this, u can solve this error. - In the link you've posted it is said that account under which worker process executes is automatically added to the IIS_IUSRS group, so shouldn't Network service account also be automatically added to the group? - I've also added the account manually to the group, but I still got access denied message - I should also mention that if I give Everyone group access permission to that application, then browser is able to receive requested page

• 06-17-2009, 3:55 AM

  In reply to

  Leo Tang - MSFT Joined on 12-11-2008, 9:47 PM Posts 918

  Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact Hi, The 401.3 error occurred because the authenticated user account (not the application pool indentity) does not have appropriate permissions to the Web page file that is requested. Hence, we should grant the authenticated user proper NTFS  permissions on the application directory. For example, if you enabled Anonymous Authentication. Then, we must insure the anonymous user identity(IUSR by default) has appropriate permissions on the application directory. Leo Tang Microsoft Online Community Support Please remember to mark the replies as answers if they help and unmark them if they provide no help.

• 06-17-2009, 4:20 AM

  In reply to

  lextm Joined on 10-22-2008, 4:18 AM Shanghai, PRC Posts 1,413

  Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact As this is an ASP.NET application, can you check if only Windows authentication is used and ASP.NET impersonation is enabled? If so, the 401.3 can be caused by impersonation. Also please let us know if this server is hardened before. Lex Li Support Engineer at Microsoft --------------------------- This posting is provided "AS IS" with no warranties, and confers no rights.

• 06-18-2009, 5:38 PM

  In reply to

  carewithl Joined on 06-12-2009, 11:29 PM Posts 3

  Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact Normal 0 false false false MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} Normal 0 false false false MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} hi   * I’ve created a couple of new ASP.NET application and configured them to use Forms authentication and it all worked well. But the two applications I’ve originally complained about for some reason still deny me an access, even though they are configured exactly the same as the new applications ( I guess this isn’t much of a problem, as long as any  other applications I’ll create work as expected, but it’s still weird )    * Anyways, since now applications  grant access to worker process as long as IIS_IUSRS has access permissions, is it safe to assume that if worker process is running under Network service account, this account will also be automatically added to IIS_IUSRS group when this worker process runs?   lextm:  As this is an ASP.NET application, can you check if only Windows authentication is used and ASP.NET impersonation is enabled? If so, the 401.3 can be caused by impersonation.   ASP.NET impersonation is disabled by default and the two applications use forms authentication   lextm: Also please let us know if this server is hardened before.     What do you mean by hardened?   thank you

• 06-18-2009, 6:56 PM

  In reply to

  lextm Joined on 10-22-2008, 4:18 AM Shanghai, PRC Posts 1,413

  Re: IIS worker process is denied an access, even though I've grant it access permissions Reply Contact If you have new sites working, a comparison of the broken and the working ones can show some differences. Please ignore my old questions as you use Forms authentication. Lex Li Support Engineer at Microsoft --------------------------- This posting is provided "AS IS" with no warranties, and confers no rights.