I'm trying to get IIS 8 on a brand new Server 2012 up and running to run a .net 4.5 app and I can't get it to work across drives
Error: 500.19
Module
IIS Web Core
Notification
Unknown
Handler
Not yet determined
Error Code
0x80070005
Config Error
Cannot read configuration file due to insufficient permissions
Config File
\\?\D:\callsheet-test\web.config
The current site is just a single file index.html.
If I copy the folder to anywhere on c: like c:\callsheet-test\ or c:\inetpub\callsheet-test it works perfectly once I change the target location in IIS 8 (site > basic settings).
It doesn't matter if there is an web.config file as a complex mvc/webforms app gives the same error.
I have tried copying the file with permissions and even thought the permissions seem to match for all users. I am still getting this error.
I have deleted the partition and and recreated it as a mount point c:\mount and the same issue happens. Copy the files to c:\notamount and they work fine.
This server is running on a VMware server. Windows 2012 x64 Standard.
Based on further investigation of the problem (via link in my comment above), I've found a workaround via here: change the Group Policy value of "Audit Removable Storage" from "Not Configured" to "No Auditing" and reboot. Bizarre I know. This setting is in Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access.
Even though we're using VMWare and not Hyper-V this workaround still worked for me. Hopefully Microsoft can provide a answer.
I also had the same error and the solution was similar. I had installed Sql Server 2012 on Windows Server 2012 and it was at this time that I noticed IIS worker processes running from the system C: drive were unable to access configuration files on the E: drive. The site could only be loaded when on the C: drive, despite all the necessary NTFS permissions being granted through IIS_IUSRS, IUSR, Users and/or even the specific AppPool itself. This became evident when IIS couldn't access the E: drive even when running the AppPool (.NET 4.5) using an admin account other than the ApplicationPoolIdentity account (IIS APPPOOL.NET v4.5 in this context - verified in procexp.exe). Installing Sql Server 2012 was throwing errors during installation and required enabling auditing for object access among other settings.
Solution:
Run -> secpol.msc
Security Settings -> Local Policies -> Audit Policy
Change "Audit Object Access" policy to "No Auditing"
Hopefully, this background helps ease someone's headache. :-)
Related
Today our HTTP server had been updated with KB5001382, KB5001393 and KB5001403.
It's a windows server 2012R2 with IIS8 installed
But after those updates I started getting an error on one of my classic asp pages.
set xml0 = Server.CreateObject("AspXml.AspXml")
set xml = xml0.HttpGet(XML_File)
xml.FirstChild2() (error on this line)
Error message:
Microsoft VBScript runtime error '800a01a8'
Object required: 'xml'
I tested the XML_file and it loads fine local and on te server (browser).
My hosting provider says its something about case sensitivity but I can't imagine what they mean...
Please make sure IIS and permissions to registry/files/folders related to the DLL involved.
Searched the registry for the Object name. In this case "AspXml.AspXml"
For all registry entries, you should take ownership of the parent registry folders, so please give read access to IIS user account.
Make sure the files/folders had read/execute permission for the IIS user account(s).
Registered the DLL at the command line for good measure.
Rebooted because restarting IIS didn't seem to do it.
I have been trying to browse a website run under IIS Express VS2019 from another computer on the same network. I see the following error.
Bad Request - Invalid Hostname
I found several discussions where people suggested adding bindings and I did try adding so many different bindings in applicationhost.config with specific hostname, IP, hostname+ip, wildcards. When I add any binding or modify the existing localhost binding VS 2019 start giving me the following error
Unable to connect to web server 'IIS Express'
I am running VS2019 as an admin. What else I am missing?
Here is what I discovered. I do not have admin privileges on my local PC. Our sysadmin had created a shortcut for me which launches VS2019 as an admin. However, the VS was still not run as elevated Admin privileges. Turns out, you need to be an admin, and you must right-click the VS2019 shortcut and choose Run As Administrator with a shield and say Yes to the warning. The shortcut wasn't doing none of that. Now my custom IIS Express bindings are picked up from applicationhost.config without any issue.
BLUF
Our application is attempting to write a file to a UNC folder using an ASP.NET web service running under .NET 4.5, IIS 7.5, and Windows Server 2008 R2. However, any attempt to write the file to the desired location results in an access denied exception.
The task seems simple however me and my team have been troubleshooting this for a while now and we are stumped as to what may be causing the error. Below are the details of our setup and what we have tried and found so far. Names have been changed to protect the innocent.
Environment Setup
The web server, mywebserver, has a website named My.Site.Com with a corresponding application pool named My.Site.Com. The application pool is configured as shown below.
.NET Framework Version : v4.0
Enable 32-bit Applications : False
Managed Pipeline Mode : Integrated
Name : My.Site.Com
Identity : ApplicationPoolIdentity
Load User Profile : False
The UNC path we are attempting to write to is \myotherserver\mydirectories\output where mydirectories is the actual share. On this share a domain group named mygroup-www has been granted full permissions to the share and all subfolders. The machine account (i.e., mywebserver) is a member of this mygroup-www group.
NOTE: For the moment, this UNC path actually lives on the same
machine, mywebserver. However, this will eventually be moved to a machine other
than mywebserver in our test environment and in the production environment
when that it is ready. Currently, I only have the one test environment to troubleshoot with.
The error can be replicated by executing the following code.
[WebMethod]
[ScriptMethod(UseHttpGet = false, ResponseFormat = ResponseFormat.Json)]
public string ExportReport(int reportId)
{
try
{
string output = ConfigHelper.OutputPath + "test.html"; // UNC path
string url = ConfigHelper.VirtualPath + "test.html";
string[] lines = { "Hello", "World!" };
File.WriteAllLines(output, lines); // Access Denied!
return url;
}
catch (System.Exception ex)
{
Logger.ErrorException("Error exporting report", ex);
throw;
}
}
Troubleshooting
Failed Attempts
We tried various combinations of group/user permissions on the folders (listed below). When running these tests we also ran Process Monitor. For each configuration we saw the same result. The w3wp.exe process attempted to create the file in the desired location but reported a result of ACCESS DENIED. The user of each configuration was IIS APPPOOL\My.Site.Com as expected.
Granting mydomain\mymachine$ full permissions to \myotherserver\mydirectories
Granting mydomain\mymachine$ full permissions to \myotherserver\mydirectories\output
NOTE: I have also tried modifying the code so that it would read a
simple file from \myotherserver\mydirectories\output. When
attempting to read the file, the process fails with an ACCESS DENIED
message as it did when writing the file.
Successful Attempts
We also tried several configurations that worked.
Grant the local IIS APPPOOL\My.Site.Com permissions
The first configuration to work was to grant the IIS APPPOOL\My.Site.Com full permissions to \myotherserver\mydirectories The file was successfully written however the process's user was quite unexpectedly a domain account that was set up for a web application on the same machine in another website. This remains very confusing but worked as the 'other' account also has write permissions to the share.
This won't work in production as we cannot use local accounts to grant access to networked resources but is an interesting data point nonetheless.
Change the App Pool Identity to Domain User
The second configuration that worked was to change the My.Site.Com application pool's identify to domain account that had full permissions to \myotherserver\mydirectories. This was a 'vanilla' domain account that was manually created by us. We did not capture what the user of the process was but that may be another useful data point.
This option may be possible, however it breaks away from best practices with IIS 7.5 and may not be allowed in our production environment due to fairly stringent IT policies.
Run the Site On My Development Machine
The third test was to run the site locally on my development machine, mydevmachine. My local IIS configuration is identical to mywebserver with the exception that I am running Windows 7 instead of Windows Server 2008. I granted full permissions for mydomain\mydevmachine to the \myotherserver\mydirectories and ran the application. The file was successfully written. According to Process Monitor the user for the process was correctly set to IIS APPPOOL\My.Site.Com.
Conclusion
We would like to enable write access as designed using the machine account of mywebserver. We have read ApplicationPoolIdentity user cannot modify files in shared folder in Windows Server 2008 and Permissions for Shared Folder for IIS 7 Application Pool Identity Across Domain and Application Pool Identities.
According to this information we should be able use the machine account to grant read and write access to networked resources such as the UNC path. In fact, I can do this in the desired manner when running the web site from my development machine.
There are a couple thoughts that come to mind. Perhaps there is something wrong with the machine account of the test web server. Or perhaps that 'other' software is interfering with the process somehow.
Any thoughts as to what may be causing this issue? What else should we do to troubleshoot?
Reboot your 'mywebserver'.
Marvel at the now mysteriously functional ApplicationPoolIdentity.
Install MS HotFix KB2545850 and learn the details about this bug in KB2672809 which also shows the steps to reproduce and demonstrate this apparently random problem. Direct download link here.
Speculate why Microsoft has not managed to release a normal windows update for this in the 3 years since that hotfix was published. While people still continue running into it and pulling their hair out because of this obscure problem.
Learn about the other folks who have shared and enjoyed this gift from MS that still continues to keep on giving:
IIS application using application pool identity loses primary token?
DirectoryServicesCOMException 80072020 From IIS 7.5 Site Running Under ApplicationPoolIdentity
ApplicationPoolIdentity cannot access network resources
ApplicationPoolIdentity IIS 7.5 to SQL Server 2008 R2 not working
Windows Authentication Failed when using application pool identity
IIS 7.5 stops using machine account to connect to network resource when using AppPoolIdentity
Your Windows 7 dev machine probably worked fine because it reboots more often than the server. Congrats on your very well written and thorough bug report. I rarely see that here.
I had similar problem accessing a network share using AppPoolIdentity in an ASP.NET application (access denied).
Using NetworkService account or other domain account worked but these were not the best solution.
I performed almost all the tests you did but finally found something that worked.
I figured out that the Network Service account was not used when accessing the shares, just like you did (i expected domain\machine$ account)
This worked for us:
On your IIS web site, go to Authentication and change the Anonymous Authentication item to "Application Pool Identity". It's by default set to "IUSR". This solved our problem.
Also maybe activating ASP.NET impersonation (still in Authentication menu) may help.
Thibault
I have faced same issue, I resolved by creating one domain account for each environemt (QA, STAGE, PRODUCTION). In Application pool identity I have set custom account and I used domain user for respective account. Now It gives me the ability to write and read the files from UNC Path.
Mainly looking to answer my question #1 below, but more knowledge would be appreciated.
I tried to use these resources during my investigation, but was unsuccessful:
http://social.msdn.microsoft.com/Forums/en/sqldatabaseengine/thread/f5eb164d-9774-4864-ae05-cac99740949b (For this error: Failed to generate a user instance of SQL Server due to failure in retrieving the user's local application data path. Please make sure the user has a local user profile on the computer. The connection will be closed.)
http://social.msdn.microsoft.com/forums/en-US/sqlexpress/thread/6dfdcc22-7a81-4e8f-a947-c1ce6982d4b3/ (For this error: CREATE DATABASE permission denied in database master. An attempt to attach an auto-named database for file ? failed. A database with the same name exists, or specified file cannot be opened, or it is located on UNC share.)
Questions
1.) Why does this error occur while running the Telerik Rad Controls for ASP.NET AJAX "Live Demos" project with IIS 7 (Running Telerik Live Demos works fine using ASP.NET Development Server with this connection string)
Failed to generate a user instance of SQL Server due to failure in retrieving the user's local application data path. Please make sure the user has a local user profile on the computer. The connection will be closed.
2.) How is creating a SQL Server Express instances different in IIS 7, from ASP.NET Development Server & SSMSE
3.) Are there certain attributes of a SQL connection string not allowed when running a website on different contexts (based on #2).
Environment:
I'm not running the "Live Demos" .NET 3.5 ASP.NET web application via the ASP.NET Development Server (feature that pops up in your system tray and picks a port for you after clicking play in Visual Studio). That works just fine! I'm running the website on IIS 7. SQL Server Express is using the NETWORK SERVICE user in Control Panel > Administrative Tools > Services > SQL Server (SQLExpress).
Using this connection string provided with the installed "Live Demos" web application demo project:
<add name="NorthwindConnectionString"
connectionString="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|Northwind.mdf;Integrated Security=True;User Instance=True"
providerName="System.Data.SqlClient" />
I've tried setting "User Instance=False", but that just throws another error:
CREATE DATABASE permission denied in database master. An attempt to attach an auto-named database for file ? failed. A database with the same name exists, or specified file cannot be opened, or it is located on UNC share.
(where "?" is the path of the *.mdf file - C:\Users\\MyDocuments\Visual Studio 2008\Projects\TelerikDemos\Telerik\RadControls for ASP.NET AJAX Q2 2011\Live Demos\App_Data\Northwind.mdf .. Stack Overflow italics is broken with some of those characters, so I had to remove that path)
Someone answered me on a previous question to set this "User Instance=False", but it appears User instances have nothing to do with whether or not you use SQL Express. User Instances are simply a feature of SQL Express that allows a very unprivileged user to host a database instance in it's own user context.
Note, this Northwind database is stored in an *.mdf file in the App_Data folder (under the "Live Demos" root application directory) along with the *.ldf (log file). I did previously try attaching the *.mdf files as actual databases under the "Databases" folder (in the SSMSE Object Explorer tree), but later removed them.
Web application "Live Demos" root folder (and nested folders/files) have the following users assigned with ALL privileges:
- IIS APPPOOL\Telerik ("Telerik" is the name of my application pool in IIS 7 for this site)
- IUSR
- NETWORK SERVICE
Making a note for myself about this SQLExpress master database query:
SELECT * FROM sys.dm_os_child_instances
Also tried different combinations of *.mdf & *.ldf permissions while also changing the user on the SQL Server (SQLExpress) Windows 7 service (Control Panel > Administrative Tools > Services) .. and also restarted the service after making those changes.
To reproduce:
download the Telerik Rad Controls for ASP.NET AJAX. Set the permimssions I mentioned in the "Live Demos" folder under Program Files\Telerik, change the .NET version of the web application to .NET 3.5, switch out their 3.5 web.config file with the normal web.config file in that folder. You have to use Visual Studio 2010, but I am running this in Visual Studio 2008 (with a little grunt work I did because our company is not yet on VS2010). Also switch out the proper Bin35 assemblies into the "Live Demos" folder Bin folder. Compile the solution. Create an IIS 7 website. Add Windows authentication. Enabled anonymous and Windows authentication.. all others are disabled. Set application pool to use Classic and 32 bit.
Then navigating to this URL and clicking the "First Look" image.
http://localhost/combobox/examples/overview/defaultcs.aspx
====================
More evidence will be provided if requested.
You are using a connection string with trusted authentication = true. This means that the connection uses the security context of the calling process.
When you run with the development server you are running in the security context of the logged in user, so every thing works fine.
When you run in IIS you are in the security context of the application pool process, which is NETWORK SERVICE, which does not have a user profile, therefore it crashes.
You can fix it by either:
Change the identity of the application pool to a normal user with access to the database
Use a connection string with user name and password
IIS doesn't load the Windows user profile, but certain applications might take advantage of it anyway to store temporary data. SQL Express is an example of an application that does this. However, a user profile has to be created to store temporary data in either the profile directory or in the registry hive. The user profile for the Network Service account was created by the system and was always available. However, with the switch to unique Application Pool identities, no user profile is created by the system. Only the standard application pools (DefaultAppPool and Classic .NET AppPool) have user profiles on disk. No user profile is created if the Administrator creates a new application pool.
However, if you want, you can configure IIS application pools to load the user profile by setting the LoadUserProfile attribute to "true".
https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities
I used the web platform installer to install the Orchard CMS but when the setup web page comes up for the CMS, once I submit my details, the following error is shown on the orchard system for the first time:
Setup failed: Exception has been
thrown by the target of an invocation.
Exception has been thrown by the
target of an invocation. Access is
denied. (Exception from HRESULT:
0x80070005 (E_ACCESSDENIED))
I have checked my application pool and that user has full permissions to the app data folder which is where the local database is created (I think that is where it is falling over).
It creates a error log file at the same time but it is empty which is handy.
Anyone else had any issues with running the first time setup?
I have looked on there project site but troubleshooting documentation is very thin: http://www.orchardproject.net/docs/Installing-Orchard.ashx
Ok, here is a solution.
Although I managed to install Orchard using the existing SQL Server, I was still curious about this issue and not working with SQL Server Compact. Apparently it was some permission problem with folder where SQL CE should be put, well that was my thinking.
Then I found this answer here at SO Deploying SQL CE 4 to IIS 7 - Special Permissions Needed? and kaboom! that's it. There were no permissions on bin folder for IUSR, even though I added it for parent folder. Hm, whatever happened, now it's gone.
Might be unrealted but the very first thing you should check is whether the app pool is configured to use .NET 4.0.