IIS 7 and Above
COM Object problems
Last post Sep 11, 2006 03:53 PM by iisray
Aug 03, 2006 08:02 PM|rstrahl|LINK
I've run into a problem with IIS 7 and loading some Visual FoxPro COM Servers that I can't seem to work around.
I've created the simplest of COM servers which basically just echos a string back. Set it up as COM object, registered, tested from VBScript on the command line all works fine. I also adjusted permissions on the COM object to allow Network Service to read
the DLL server.
If I run this in IIS 7 I get an immediate 500 Server Error. And in fact it hoses the entire Web server so any subsequent requests against any page fail. Including applications in a completely different AppPool!
I've tried this both in Integrated Mode (DefaultAppPool) as well as the ISAPI pipeline (ASPNet20).
In this case it happens to be a classic ASP applicatino that's not loading the object, but i also checked ASP.NET with Interop imports and it also bombs with a 500 error immediately. Using the VS test server the object runs fine so I'm pretty sure the problem
is not in the component itself.
This is Vista Beta 2...
There are a few other weird issues related to COM. The COM+ manager on the machine doesn't seem to allow adding components through the UI, so I ended up not testing for this scenario.
Aug 04, 2006 05:58 PM|mvolo|LINK
Can you provide the detailed 500 error you are getting? That should hold the key - otherwise, we can move on to capturing a FREB log. Also, is there anything being written to the event log?
There is also a known issue with running ASP.NET aspcompat pages in Integrated mode (you need this if your com object was written with VB6 and uses STA) in beta2 - see
Aug 05, 2006 01:55 PM|rstrahl|LINK
Duh... damn IE 7 <s>. It blocks off the error message and displays only the generic 500 error page even though there's a response.
The response is:
Server.CreateObject failed while checking permissions. Access is denied to this object.
However, I'm not sure what permissions may be required. I set Windows permissions on the server to allow access to EveryOne with full rights. I also added the same promiscuous permissions to the runtimes just in case, so from a Windows perspective the files
required to launch should be accessible.
It's not working and I'm not sure what other permissions might be required...
+++ Rick ---
Aug 16, 2006 04:09 PM|iisray|LINK
I think I have the repro on my side. And the issue that I saw seem to be due to a known bug (still under investigation either this caused
by IIS or COM).
There is a temp. work around for this known bug; and would like to see if this solve the issue on your side.
Here is one line of IIS configuration change that you need to try:
Adsutil set w3svc/AspExecuteInMta 1 (if you want to change back to the default; just set it to 0)
Please let us know what is the result after the above work around.
Also, it would be great if you can see my repro steps sound right to you or not (content based on the zip file provided by you):
Install Visual FoxPro9 on Vista with IIS7 installed
Create an web application to map to the physical directory that contain the “testserver.asp”
Make a request to this asp page.
Also, if possible, could you let me know the build number that you are using?
Aug 17, 2006 01:50 AM|rstrahl|LINK
Where is ADSUTIL? I can't find it offhand.
I used this instead which should do the same:
o.AspExecuteInMta = 1
Build is Beta 2, 5384...
Yes that seems to work, the server now loads, although there appear to be still some issues in regards to security, but that may have to do with the environment set up here.
So what does that flag do exactly? The server is an STA server running inProc in the worker process, so I'm curious to understand what this flag actually does. And I hope this is just a workaround and not the default behavior? Does it affect other behavior
on the server?
Aug 17, 2006 03:33 PM|iisray|LINK
If you have it, you should be able to find it under %SystemDrive%\inetpub\adminscripts.
You can also use ADSI script like what you have done as well. One thing you may want to change is that you may want to change this property setting down to the web application level (instead of setting it globally).
This property allows ASP to run all of its threads in MTA (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/iissdk/html/3f7654d8-34b6-49b1-892c-88f79e8aff9f.asp)
This should be just temporary work around until we have this fix.
Aug 17, 2006 07:44 PM|rstrahl|LINK
Ray I'm confused by this behavior then...
VFP COM servers are STA components, so running in MTA might allow it to run but will cause other problems (TLS overlap, global vars overlap etc.). Normally VFP components run in ASP.NET with ASPCOMPAT on to work properly or they will have major problems.
So the default mode would be STA, but why wouldn't the component run in that if it is in fact an STA component?
Can you confirm what the intended behavior is?
This is not crucial to me at the moment really, I just would like to know what the behavior is supposed to be. I'd expect it to behave the same as stock ASP would in previous versions of IIS.
Also does this affect anything besides COM servers loaded into pages or into ASP.NET? It's the COM threading model that gets set here? I'm trying to understand what other implications this flag might have on performance especially on ASP.NET application
if they don't use COM at all.
Aug 21, 2006 07:22 PM|iisray|LINK
Rick, sorry about the confusion.
The intended behavior is the same as in IIS6. This is caused by a known product bug; and the work around is just for temporary until this product bug get fix.
Aug 22, 2006 05:50 AM|adipeka|LINK
I am facing the same problem on Windows Vista Beta 2,5384.
We have a 32-bit COM dll developed using VC++ 6.0. We have a COM+ server to redirect the calls on 64-bit machine.
It works well from the built-in "Administrator" account but from any other domain account I get the following error.
The call to Server.CreateObject failed while checking permissions.Access is denied to this object.
I have tried the workaround i.e. setting AspExecuteInMta to 1 but it does not work.
Can I get any help on this?
Aug 24, 2006 08:41 PM|iisray|LINK
unless you get 500 status code with error message like "Calling on wrong thread...", otherwise the temporary work around that I suggested to Rick won't apply to your case.
I have replied your issue in another link (http://forums.iis.net/1380181/ShowThread.aspx#1380181 ). We can disscuss your case from there.
Sep 11, 2006 03:53 PM|iisray|LINK
I highly recommand to read the links in the following post regarding security changes in