Search results matching tag 'permissions'

Remote and automated IIS 7 management from build server - permissions issue

wimdows — Wed, 04 Nov 2009 10:21:15 GMT

I've posted the following question on StackOverflow:

Here's the scenario:

Win2003 Build Server (CCNET)
IIS7 target deployment server

The various MSBuild tasks (Sdc.Tasks, MSBuild Community, MSBuild Extension Pack) for doing this (creating VDirs, setting AppPool properties) are not suitable for at least one or more of the following reasons:

No support for IIS 7.
No possibility to pass domain username/password to perform the operation.
Microsoft.Web.Management.dll is not available on build server.
'Access Denied' error.

There are no issues creating Vdirs on IIS 6 - though we're actually shelling out to iisvdir.vbs, as using any of the MSBuild task as described above seem to either not support domain username/password auth when performing the operation or will simply throw a basic 'Access Denied' message (despite having the appropriate permissions on the IIS 6 metabase).

Also - bear in mind that the various methods work perfectly on IIS 7 if not specifying a specific domain user/pw as long as the current authentication context has the correct permissions, but for obvious reasons we don't want all of our CCNET build to run in that context.

I've even used psexec.exe to run appcmd.exe on the box remotely, which also works fine if the current security context has appropriate permission, but as soon as you specify username/password on psexec, you get an error message saying "Cannot read configuration file due to insufficient permissions." The user specified is a domain account, and is part of the local Administrators group on the 2008 server.

Also - I've ended up rolling my own RunAs MSBuild task, inheriting from the Exec task and using programmatic impersonation. I then use this to call psexec without specifying the username and password in psexec, but by impersonating when shelling to psexec, but I'm simply getting an exitcode of 1 - without any more details.

As you see, I've pretty much exhausted all options, or so I reckon.

If you can think of anything else, or have achieved managing IIS7 remotely, from an automated process on a non IIS7 box (using a specific non local admin user), please let me know.

ASP & Access 4005 error: defining 32 bit dsn on 64 bit windows

timpollard — Fri, 30 Oct 2009 09:55:26 GMT

I'm having trouble making classic asp with access db work on Windows 7. On one box I have it all working fine on a 32 bit W7 Pro install, but on my main development server I am using 64 bit W7Pro and this one still doesn't work.

On both machines I have used the icacls workaround to grant appropriate permissions on the Users/Useraccount/AppData/Local/Temp folder, have also fiven that folder permissions for the IUSR account, and the same for the folder which contains the db. This worked for the 32 bit machine, but not the 64.

I then used the Process Monitor to trace w3wp.exe and discovered, if I'm reading the log file right, that the problem is that w7 64 bit can't find the dsn.

When I set up the dsn I went first to the default ODBC Admin console, only to find that in a 64 bit OS this only offers 64 bit drivers. I googled that and found that there is a legacy 32 bit version, which I used to create the dsn. However, although it appears to be there when viewed in the 32 bit ODBC Console, the 64 bit OS doesn't seem to recognise it.

Can anyone help, please?

The log file is below. I've highlighted the line which appears to suggest it can't find the dsn.

Tim

"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"09:34:39.4159347","w3wp.exe","7960","CreateFile","D:\My Documents\Web sites\dollman","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, No Buffering, Attributes: RE, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR, OpenResult: Opened"
"09:34:39.4159860","w3wp.exe","7960","QueryAllInformationFile","D:\My Documents\Web sites\dollman","BUFFER OVERFLOW","CreationTime: 28/02/2009 17:13:45, LastAccessTime: 21/04/2009 14:00:19, LastWriteTime: 21/04/2009 14:00:19, ChangeTime: 21/04/2009 14:00:19, FileAttributes: D, AllocationSize: 8,192, EndOfFile: 8,192, NumberOfLinks: 1, DeletePending: False, Directory: True, IndexNumber: 0x2000000013675, EaSize: 0, Access: Generic Read, Position: 0, Mode: Sequential Access, No Buffering, AlignmentRequirement: Word"
"09:34:39.4160668","w3wp.exe","7960","CreateFile","D:\My Documents\Web sites\dollman\DEFAULT.HTM","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Attributes: RE, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR"
"09:34:39.4161531","w3wp.exe","7960","CreateFile","D:\My Documents\Web sites\dollman\default.asp","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Attributes: RE, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR, OpenResult: Opened"
"09:34:39.4163917","w3wp.exe","7960","QueryAllInformationFile","D:\My Documents\Web sites\dollman\default.asp","BUFFER OVERFLOW","CreationTime: 28/02/2009 17:13:45, LastAccessTime: 28/02/2009 17:13:45, LastWriteTime: 06/11/2008 09:39:08, ChangeTime: 29/10/2009 15:01:48, FileAttributes: A, AllocationSize: 24,576, EndOfFile: 23,009, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x200000001367f, EaSize: 0, Access: Generic Read, Position: 0, Mode: Sequential Access, AlignmentRequirement: Word"
"09:34:39.4164733","w3wp.exe","7960","CreateFile","D:\My Documents\Web sites\dollman","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Synchronize, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"09:34:39.4165243","w3wp.exe","7960","NotifyChangeDirectory","D:\My Documents\Web sites\dollman","","Filter: FILE_NOTIFY_CHANGE_FILE_NAME, FILE_NOTIFY_CHANGE_DIR_NAME, FILE_NOTIFY_CHANGE_ATTRIBUTES, FILE_NOTIFY_CHANGE_SIZE, FILE_NOTIFY_CHANGE_LAST_WRITE, FILE_NOTIFY_CHANGE_CREATION, FILE_NOTIFY_CHANGE_EA, FILE_NOTIFY_CHANGE_SECURITY, FILE_NOTIFY_CHANGE_STREAM_NAME, FILE_NOTIFY_CHANGE_STREAM_SIZE, FILE_NOTIFY_CHANGE_STREAM_WRITE"
"09:34:39.4165519","w3wp.exe","7960","ReadFile","D:\My Documents\Web sites\dollman\default.asp","SUCCESS","Offset: 0, Length: 23,009, Priority: Normal"
"09:34:39.4165933","w3wp.exe","7960","QuerySecurityFile","D:\My Documents\Web sites\dollman\default.asp","SUCCESS","Information: Owner, Group, DACL"
"09:34:39.4166178","w3wp.exe","7960","CloseFile","D:\My Documents\Web sites\dollman\default.asp","SUCCESS",""
"09:34:39.4167040","w3wp.exe","7960","QueryOpen","D:\My Documents\Web sites\dollman\Default.asp\web.config","PATH NOT FOUND",""
"09:34:39.4169856","w3wp.exe","7960","RegOpenKey","HKU\S-1-5-17","NAME NOT FOUND","Desired Access: Maximum Allowed"
"09:34:39.4170093","w3wp.exe","7960","RegOpenKey","HKU\.Default","SUCCESS","Desired Access: Maximum Allowed, Granted Access: Read"
"09:34:39.4170545","w3wp.exe","7960","RegOpenKey","HKU\.DEFAULT\Control Panel\International","SUCCESS","Desired Access: Read"
"09:34:39.4170794","w3wp.exe","7960","RegCloseKey","HKU\.DEFAULT","SUCCESS",""
"09:34:39.4170978","w3wp.exe","7960","RegQueryValue","HKU\.DEFAULT\Control Panel\International\LocaleName","SUCCESS","Type: REG_SZ, Length: 12, Data: en-GB"
"09:34:39.4171216","w3wp.exe","7960","RegCloseKey","HKU\.DEFAULT\Control Panel\International","SUCCESS",""
"09:34:39.4174813","w3wp.exe","7960","RegQueryKey","HKU\.DEFAULT","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4175101","w3wp.exe","7960","RegOpenKey","HKU\.DEFAULT\SOFTWARE\ODBC\ODBC.INI\dsnDollman","NAME NOT FOUND","Desired Access: Read"
"09:34:39.4175380","w3wp.exe","7960","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4175629","w3wp.exe","7960","RegOpenKey","HKLM\SOFTWARE\ODBC\ODBC.INI\dsnDollman","NAME NOT FOUND","Desired Access: Read"
"09:34:39.4175917","w3wp.exe","7960","RegQueryKey","HKU\.DEFAULT","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4176173","w3wp.exe","7960","RegOpenKey","HKU\.DEFAULT\SOFTWARE\ODBC\ODBC.INI\Default","NAME NOT FOUND","Desired Access: Read"
"09:34:39.4176422","w3wp.exe","7960","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4176668","w3wp.exe","7960","RegOpenKey","HKLM\SOFTWARE\ODBC\ODBC.INI\Default","NAME NOT FOUND","Desired Access: Read"
"09:34:39.4176947","w3wp.exe","7960","RegQueryKey","HKU\.DEFAULT","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4177189","w3wp.exe","7960","RegOpenKey","HKU\.DEFAULT\SOFTWARE\ODBC\ODBC.INI\ODBC Data Sources","NAME NOT FOUND","Desired Access: Query Value"
"09:34:39.4177434","w3wp.exe","7960","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4177671","w3wp.exe","7960","RegOpenKey","HKLM\SOFTWARE\ODBC\ODBC.INI\ODBC Data Sources","NAME NOT FOUND","Desired Access: Query Value"
"09:34:39.4177917","w3wp.exe","7960","RegQueryKey","HKLM","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4178215","w3wp.exe","7960","RegOpenKey","HKLM\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\ODBC Data Sources","SUCCESS","Desired Access: Read"
"09:34:39.4178568","w3wp.exe","7960","RegSetInfoKey","HKLM\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\ODBC Data Sources","SUCCESS","KeySetInformationClass: KeySetHandleTagsInformation, Length: 0"
"09:34:39.4178813","w3wp.exe","7960","RegQueryValue","HKLM\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\ODBC Data Sources\dsnDollman","SUCCESS","Type: REG_SZ, Length: 64, Data: Microsoft Access Driver (*.mdb)"
"09:34:39.4179169","w3wp.exe","7960","RegCloseKey","HKLM\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\ODBC Data Sources","SUCCESS",""
"09:34:39.4179802","w3wp.exe","7960","RegQueryKey","HKCR","SUCCESS","Query: HandleTags, HandleTags: 0x0"
"09:34:39.4180058","w3wp.exe","7960","RegOpenKey","HKCR\CLSID\{C8B522CB-5CF3-11CE-ADE5-00AA0044773D}\ExtendedErrors","SUCCESS","Desired Access: Read"
"09:34:39.4180372","w3wp.exe","7960","RegEnumKey","HKCR\CLSID\{C8B522CB-5CF3-11CE-ADE5-00AA0044773D}\ExtendedErrors","SUCCESS","Index: 0, Name: {c8b522cc-5cf3-11ce-ade5-00aa0044773d}"
"09:34:39.4180794","w3wp.exe","7960","RegCloseKey","HKCR\CLSID\{C8B522CB-5CF3-11CE-ADE5-00AA0044773D}\ExtendedErrors","SUCCESS",""
"09:34:39.4184591","w3wp.exe","7960","CloseFile","D:\My Documents\Web sites\dollman","SUCCESS",""

WSS 3.0 in IIS 7

WendySancho — Thu, 10 Sep 2009 22:18:21 GMT

Hi everyone. I have a site in sharepoint wss 3.0 that uses web user controls with ajax enabled. The site works perfectly in windows server 2003 with iis 6. I generated the necesary installers in windows server 2003 and ran them in windows server 2008. There were some minor issues at first, but in the end everything seemed to be working just fine, except for the pop-ups; I keep getting a "403 Forbidden" error. Any ideas? Thanks :)

IIS 6 Service Unavailable issue

cmueller — Mon, 31 Aug 2009 14:15:47 GMT

Hello -

I've been trying to resolve an IIS issue for the last few days, and am completely stumped. Sorry if this is long, but I want to make sure I get all the information out so as to not duplicate efforts.

I have three separate environments, development, staging, and production, all consisting of a pair of load balanced Windows 2003 servers. In preparation for a migration we are doing, I had started installing third party software on the production web servers (namely, the old Crystal 9.1 libraries included with Visual Studio 2003, Crystal 10.5 redistributable from the VS 2008 install, and a pair of Infragistics libraries). These installs worked fine on all development and staging servers, and on one production server.

On that second production server, the installs completed fine, but IIS would no longer run any of it's websites - they would all return with SERVICE UNAVAILABLE, and in the event log, show Event ID 1009 - "The process exit code was '0xffffffff'." After doing some troubleshooting, I came across this site: http://support.microsoft.com/kb/842493. These servers aren't domain controllers, and the resolutions it proposed did not work. I did find that if I set the app pool user from our domain user to Local System, the site would work, making it a permissions issue. I tried every suggestion here: http://blogs.iis.net/brian-murphy-booth/archive/2007/03/22/how-to-troubleshoot-an-iis-event-id-1009-error.aspx with no luck.

I loaded Process Monitor on the server and checked there. No access denieds for file permissions, but they did show up for the hklm\software\microsoft\service\w3svc\parameters registry key. I checked this key and see that IIS_WPG does have permissions on it, as well as all the required registry permissions it should have for IIS to run. My domain user for this app pool is a member of IIS_WPG. Just to be sure, I granted that user full control on that registry key, yet still see access denied.

Thinking maybe I just had an install that didn't quite complete and corrupted the registry, I rebooted the server. In the past, when we had a corrupted registry, I'd get the option to start using last known good config. This time, the server booted up as if nothing was wrong, so I've lost my "last known good" registry. I thought maybe reinstalling IIS would resolve any permissions issues I had, so I went to my development server and uninstalled IIS on one of the hosts. I messed up and uninstalled it on my NLB controller (it's been a bad couple of days), which is also using Application Center to keep everything in sync. Because I didn't want to lose all of my data and settings, I quickly designated the secondary server as the controller and tried reinstalling IIS on the primary. That worked, web sites and app pools were created, but now I'm seeing the EXACT same error as above - all app pools failed with 0xffffffff. Worse still, even setting the app pool as Local System doesn't bring the site online. Even the same registry key is showing access denied when I try starting a website through Process Monitor.

So now I'm sitting with two server that are completely useless, and have no clue as to what to do, and why my permissions aren't being picked up in the registry. As I said, I'm really stumped here. Any help you can provide would be greatly appreciated.

Thanks!

Clint

Failure to run ASP when opening a new window

Doug Morris — Thu, 27 Aug 2009 02:49:18 GMT

I am running an application that opens a new window from an ASP page and runs another ASP script. This works fine on XP, WIndows 2003 and in other versions of IIS but seems to fall over on Windows 2008 and IIS7.

When the window opens it first of all asks the use to log in to the server and then produces a .NET error.

"This type of page is not served"......The type of page you have requested is not served because it has been explicitly forbidden. The extension '.asp' may be incorrect....an so on.

I have this running on a standalone machine with XP and IIS5 and on a server windows 2003 and IIS5.... And there are no problems.

The calling asp module is in a folder ../ie/calling_module.asp

The new window module is in a folder ../reports/report_module.asp

If this is an authentication or permissions issue, please let me know or does any body have any ideas?

Problems recycling Application Pool from codebehind

mjepson — Mon, 17 Aug 2009 15:39:52 GMT

Hi,

I am trying to recycle an application pool from code. This is needed, because resource files are altered using a CMS for the website, which will only show after the app pool is recycled.

I have found the code at http://www.leandrodg.com.ar/blog/2008/02/find-and-recycle-current-application-pool-programmatically-for-iis-6/ to be helpful, but it keeps confronting me with the following:

Acces is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

The application pool is running on a user account, so we can use the login for access to the SQL server using integrated security. I have tried adding the user to the administrators group and Super Users group, with no success.

Any idea how I can recycle the app pool from code or how I can get my code to work (i.e. what permissions do I set and how).

Thanks in advance!

Re: IIS6 Error when opening page

salman_arshad — Wed, 08 Jul 2009 07:42:38 GMT

Try resetting the permissions for the directory in which you extracted the files. I have had similar problems (not exactly the same though) and I was always able to fix them by resetting folder permissions. The problem usually occurred when I copied a folder containing a php app from desktop to wwwroot. The permissions from desktop (full control to the person owning the desktop, no permission to others) were copied along with the folder and by default these permissions prevent IIS from accessiong any of these files.

Assuming your IIS is setup on an NTFS file system and permissions are setup correctly for wwwroot folder:

Go to c:/inetpub/wwwroot/
Right click the trellis folder and click properties
Go to Security tab
Click Advanced
Un-check the "inherit from parent the permission entries..." checkbox
If prompted, choose the "Remove" permissions option instead of "Copy" permissions. Also, just for consistency, remove all "not inherited" permissions
Check the "inherit from parent the permission entries..." checkbox
Check "Replace permission entries on child..."
Click Apply, OK to close this dialog and Apply, OK again

If you see a windows progress bar saying "Applying security attributes" or similar then hopefully you're in business.

Permission problems on Wordpress Uploads on IIS 7

nobrainr — Wed, 17 Jun 2009 06:25:21 GMT

I'm a noob on IIS. But I've been looking everywhere for a solution but nothing works. The following mentions 2 problems. I think I've already fixed the first one but the second one is the key issue.

I have Server 2008 x64 Virtual Machine / IIS 7 / Wordpress 2.8 / MySQL NTS / PHP

Everything works fine except media uploads. When I click upload using internet explorer, the blogging platform alerts me that I have a problem:

Unable to create directory C:\inetpub\wwwroot\blog/wp-content/uploads/2009/06. Is its parent directory writable by the server?

To fix this problem, I allowed NETWORK SERVICE to have access to the uploads folder and I'm able to get as far as writing the folders and the file (*upload path*/2009/06/test.jpg)

When I look at the permissions on test.jpg, IIS_IUSRS does not have read access. I can simply change that manually and see the picture on the site.

But how can I get NETWORK SERVICE to write test.jpg with IIS_IUSRS permissions set automatically to read? I thought if my uploads folder had IIS_IUSRS permissions set, it would propagate the necessary credentials to the nested folders.

Thanks in advance.

Sync WebDAV Authoring Rules with Database

msinger — Wed, 27 May 2009 10:09:57 GMT

Hi all,

I am trying to develop a webinterface to control the webdav authoring rules. The webinterface interacts with a SQL database to store each folders authoring rules. This rules can be modified within the webinterface.

My question is, how can I sync the authoring rules stored in the database with them in application config. I looked at the post from trnsfrmrsr (http://forums.iis.net/t/1153161.aspx) and implemented a solution using the Microsoft.Web.Administration assembly. The problem with that is, that I have to run the IIS-process with sufficient rights to modify the application config - and that is not what I want. Is there another solution?

I also tried to extend the basic authentication module (http://forums.iis.net/p/1152183/1889432.aspx) to check access against my database. With this solution, I would have only one authoring rules store and no syncing is required. But it is almost impossible to get it work properly.

So, how can I realize this? Any suggestions, solutions?

IIS Shared hosting and C:\ permissions

kirill9 — Tue, 26 May 2009 09:01:21 GMT

What are the minimum permissions an IIS 7.0 worker process should have on the C:\ drive, and it's subfolders?

We are in the process of setting up a shared hosting environment, where each individual site is ran with it's own application pool and an identity of it's own system user. The site root paths are on another drive.

What permissions and on what folders on the C:\ system drive would I need to set, assuming that the rest of C:\ has full denied permissions?