IIS 7 and Above
Error Applying Security: access is denied to c:\inetpub\custerr\en-US...
Last post Feb 17, 2012 08:54 AM by Lloydz
Feb 13, 2012 04:07 PM|lloydmalvern|LINK
I get the following error even though the website is set up with Anonymous access Enabled:
===================================================================== Access is denied. Description: An error occurred while accessing the resources required to serve this request. You might not have permission to view the requested resources. Error message
401.3: You do not have permission to view this directory or page using the credentials you supplied (access denied due to Access Control Lists). Ask the Web server's administrator to give you access to 'C:\inetpub\wwwroot\myapp\index.aspx'.
-------------------------------------------------------------------------------- Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.272 ======================================================================== Help
would be much appreciated. Thanks
Feb 16, 2012 07:09 AM|Lloydz|LINK
401.3 is access denied due to acl settings. Since you enabled anonymous authentication, please ensure both IUSR and application pool identity account have at least read access to your application folder. For more information about IIS7 built-in accounts/groups,
Understanding Built-In User and Group Accounts in IIS 7
Feb 16, 2012 11:09 AM|lloydmalvern|LINK
Thanks for the link, Lloyd. The information is helpful to understand changes in the IIS7 security model.
But what was also puzzling me is that I got the error in the subject line (access denied to inetpub\custerr\en-US) when I was using the Security tab on the folder properties in Windows to change account permissions on the folder. I had right-clicked on
the inetpub folder and opened the Properties dialog and then clicked on the Security tab, and had then added IUSR to the list of users and tried to give IUSR permissions. The error occurred when I tried to apply the permissions. I was logged into my PC as
a user with domain administrator privileges. Is INetMgr.exe the only way to change permissions on those folders?
Feb 17, 2012 08:54 AM|Lloydz|LINK
By default, all users should have read access to custerr folder(you may check
this KB for all default permissions for IIS7 related folders). According to your error information in your original post, you got access denied due to insufficient perssimions to "C:\inetpub\wwwroot\myapp" folder, and I believe this is the root folder of
your website rather than the custerr folder. The issue could be solved once you grant IUSR and corresponding application pool identity proper permissions to the web site root folder.
In fact, two kinds of errors can be generated when httpError module encounters an error, a custom error or a detailed error. By default, custom errors are generated when common users visit your site while detailed errors are generated for local administrators
and developers. The default path of custom error pages stored is the in "%systemdrive%\inetpub\custerr\<Language_Tag>\", which I think is not related with the permission issue you encountered.
To change the permissions for your site folder, a direct way could be right-click the folder, select properties and switch to security tab. Same could be done in IIS Manager with "Edit Permissions.." action. Also command line could also be used to set permissions
for a folder, you may check the icacls command line for details.
Hope this can answer your question, thanks.