IIS7 - Configuration & Scripting

Re: Cannot verfy access to path

drummelhart — Mon, 05 Oct 2009 16:36:56 GMT

Yes I did grant IUSR (now that there is no IUSR_machine name) access to the inetpub folder which carries to all other existing sites. There is no change. I am still receiving:

The system could not authorize you for access.

Your Windows User Account is not a member of any Windows Group granted access to this site.

Please contact the site administrator for assistance.

Re: Cannot verfy access to path

e1ny — Sat, 03 Oct 2009 10:00:09 GMT

drummelhart:
so you are stating that I need to add IUSR to the IUSR Roles, not just domain admins, as well as the domain admins names?

This does not make sense! Why the harsh change in security. That leads to the next question of what all steps need to be completely completed before I can access a application via the local host without receiving you are not a part of a windows user group.......error.

What else am I missing?

I'm sorry if you don't like my answer, drummelhart...it's just what worked for me (g).

Did you try granting the local IUSR explicit access to the folder? I agree that this is probably the wrong way/brute force method to make it work, and there may be some other config issue that's not right. I was just desperate to get it working and found something that worked.

Re: Cannot verfy access to path

drummelhart — Fri, 02 Oct 2009 22:31:59 GMT

so you are stating that I need to add IUSR to the IUSR Roles, not just domain admins, as well as the domain admins names?

This does not make sense! Why the harsh change in security. That leads to the next question of what all steps need to be completely completed before I can access a application via the local host without receiving you are not a part of a windows user group.......error.

What else am I missing?

Re: Cannot verfy access to path

e1ny — Sun, 20 Sep 2009 18:55:49 GMT

I'm coming into this thread late, but have had the same problem off and on over the past 12 months, and think I have solved it.

For people with domains, or even people without, server 2008 has a couple of different users/groups that represent the anonymous web user, and they're not always granted access by default to folders, even those in "wwwroot".

I'm not sure I've ID'd the correct circumstances under which folders do not inherit permissions properly, but I have noticed this: On a standalone 2008 server, when creating a new folder in Windows Explorer, and then making it the root of a web in IIS Manager, IIS adds the "IIS_IUSRS" AD security group to the folder with "read/execute" permissions.

The local IUSR account on the server, however, may not be a member of this group by default, and if this is the case, then the web will exhibit all the permissions errors described in this thread, and browsing the web will return a "401 unauthorized". I leave it the forum gurus to explain the relationship between "IIS_iUSRS" and the local "IUSR" account and under what circumstances this will occur.

Anyway, I found that granting explicit read/execute permissions to the local IUSR account (by adding it under the folder's security tab in folder properties), will fix the problem, as intuitively it should. I presume that adding it to the "IIS_USRS" group in Active Directory would have the same effect, since that group is granted permissions on the folder when it's made the root of a web in IIS Manager.

That's my empiric experience...hopefully someone can explain what is the "root" issue of the problem.

Re: Cannot verfy access to path

virshu — Mon, 14 Sep 2009 03:57:33 GMT

Unfortunately, I am trying to follow the advice in this thread and I am lost. I first got a problem that I don't get anything from my C# statement s = User.Identity.Name. AuthenticationType is empty, IsAuthenticated is false, and Name is also empty. Note, that I am getting everything populated correctly when I am running through VStudio (name returns machine\userid); so my debugging options are quite limited (Console.Write always works, of course :)

After some tinkering, I suspect that the root cause for my code problem and for the problem discussed here is the same - or at least I was trying to fix this problem first and see if it helps. As suggested, I was looking for the domain\servername$ and I don't see such account. Can it be invisible or somehow hidden from my naked eye?

So, I tried to reproduce it on my local machine (standalone server, running IIS7). I have the same problem, and I tried to give NetworkService the rights on the directory - but I am still getting the same problem, and I am still not getting User.Identity.

did I misread the advice? Thank you

UPDATE: I did get it working on localhost (kinda). When I disabled Anonymous Authentication (leaving only Windows Authentication), I got an authentication popup (HTTP 401 Challenge). I would prefer to get windows authentication, since I logged in, but that's a different issue. So, while I am still curious, how to solve the problem described in this thread - I think my problem (with User.Identity) is unrelated to this.

Re: Cannot verfy access to path

qbernard — Tue, 21 Jul 2009 12:16:13 GMT

what error msgs? during runtime or verification? pls be more specific

Re: Cannot verfy access to path

norvak — Tue, 07 Jul 2009 14:08:43 GMT

I am having this same error on my server. I am not running exchange, but TSweb on Server 08. I have read all the previous messages and none of them work for me. I am still getting the error.

Re: Cannot verfy access to path

mdaniel69 — Wed, 01 Jul 2009 19:17:18 GMT

I'm getting the same message on Windows SBS 2008 running Exchange 2007. I checked all of the applications that use that particular application pool and they all have the same message w hen yo9u "test connection" under Authentication/Basic Settings. Therefore, if it does not test correctly here, it will not work at runtime. Did anyone else solve this problem? MikeD

Re: Cannot verfy access to path

qbernard — Tue, 09 Jun 2009 13:14:20 GMT

And ? did you read the previous replies?

Re: Cannot verfy access to path

SonicsSolutions — Mon, 01 Jun 2009 20:00:32 GMT

Just like another posting on this page, I have Exch 2007 on a Win Server 2008 and OWA is not working and I get the following error when testing the OWA accessin IIs:
"The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built-in account has access. Make sure that the application pool identity has Read access to the physical path. If this server is joined to a domain, and the application pool identity is NetworkService or LocalSystem, verify that <domain>\<computer_name>$ has Read access to the physical path. Then test these settings again".

Re: Cannot verfy access to path

qbernard — Tue, 31 Mar 2009 08:33:34 GMT

Did you read the previous response. built-in account can be verfiy until run time, you can ignore the msgs.

Re: Cannot verfy access to path

iis7confusion — Tue, 24 Mar 2009 01:01:11 GMT

Does anyone have a solution for this? In my case there is no remote resource and the app pool's Process Model Identity is simply 'Local Service'. I've given 'Local Service' Read access to the web application's folder. It keeps spitting back the same error:

"The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built-in account has access. Make sure that the application pool identity has Read access to the physical path. If this server is joined to a domain, and the application pool identity is NetworkService or LocalSystem, verify that <domain>\<computer_name>$ has Read access to the physical path. Then test these settings again."

Re: Cannot verfy access to path

qbernard — Wed, 18 Feb 2009 14:07:50 GMT

what error ? can't verify path? if you using built-in account this won't get verify until runtime. just make sure the app pool id has required permission on the resource, then you'll be fine.

Re: Cannot verfy access to path

jcwhite — Tue, 17 Feb 2009 16:34:11 GMT

Has anyone run across this error and found a resolution to it? I am having the same thing happen to me. Exchange 2007 on Server 2008 (64bit)

Re: Cannot verfy access to path

steve schofield — Fri, 10 Oct 2008 12:07:04 GMT

The idea of granting a machine account access is to a remote UNC share, not local to itself. Have you checked over at http://msexchange.org forums to see if anyone else has seen this issue? I'm not familar with Exchange 2007 on w2k8.

http://www.msexchange.org/articles_tutorials/exchange-server-2007/migration-deployment/installing-exchange-2007-windows-server-2008.html