IIS 6.0 3rd party app question
-
Hey, i just moved to a new webserver running win 2k3 and IIS 6.0. on my last webserver(it died) we were able to let the web application run executables from code Process.Start(blah) that were typically in their own directory under c:. they were just file converters that took .wav(user likes) and made them .ul(we like) and a TTS app that we wrote. with IIS 6.0 even with the accounts(IUSR, IWAM, etc..)having full access to the directories we get a Access Denied exception when the web app tries to run the programs. We have little experience with windows 2k3 server and IIS 6.0 the last server was win 2k with IIS 5. i've been looking on google for a while but cant find a solution that works. any help is appreciated.
-
Hey, i just moved to a new webserver running win 2k3 and IIS 6.0. on my last webserver(it died) we were able to let the web application run executables from code Process.Start(blah) that were typically in their own directory under c:. they were just file converters that took .wav(user likes) and made them .ul(we like) and a TTS app that we wrote. with IIS 6.0 even with the accounts(IUSR, IWAM, etc..)having full access to the directories we get a Access Denied exception when the web app tries to run the programs. We have little experience with windows 2k3 server and IIS 6.0 the last server was win 2k with IIS 5. i've been looking on google for a while but cant find a solution that works. any help is appreciated.
Do you know what resource is being denied? Checkout FileMon or RegMon by SysInternals (now owned by MS). Together they have helped me solve many a permissions issue. It can help you determine both the resource and the user account being used to access that resource. From there you should be able to determine the access required.
Mark's blog: developMENTALmadness.blogspot.com
-
Do you know what resource is being denied? Checkout FileMon or RegMon by SysInternals (now owned by MS). Together they have helped me solve many a permissions issue. It can help you determine both the resource and the user account being used to access that resource. From there you should be able to determine the access required.
Mark's blog: developMENTALmadness.blogspot.com
9:25:24 AM aspnet_wp.exe:2256 OPEN C:\sox\ SUCCESS Options: Open Directory Access: 00100001 9:25:24 AM aspnet_wp.exe:2256 DIRECTORY C:\sox\ NO SUCH FILE FileBothDirectoryInformation: sox.exe "* 9:25:24 AM aspnet_wp.exe:2256 CLOSE C:\sox\ SUCCESS 9:25:24 AM aspnet_wp.exe:2256 OPEN C:\ SUCCESS Options: Open Directory Access: 00100001 9:25:24 AM aspnet_wp.exe:2256 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: sox 9:25:24 AM aspnet_wp.exe:2256 CLOSE C:\ SUCCESS 9:25:24 AM aspnet_wp.exe:2256 OPEN C:\sox\ SUCCESS Options: Open Directory Access: 00100001 9:25:24 AM aspnet_wp.exe:2256 DIRECTORY C:\sox\ SUCCESS FileBothDirectoryInformation: sox.exe 9:25:24 AM aspnet_wp.exe:2256 CLOSE C:\sox\ SUCCESS it simply says no such file when it tries to access a file i know is there. the aspnet account has full control in that directory. this is from my local machine that has the same problem, but is win xp with iis 5.1 the code ran perfectly on a win2k box with iis 5.0. Could running the application pool with the Local Service account cause a problem in our production environment?
-
9:25:24 AM aspnet_wp.exe:2256 OPEN C:\sox\ SUCCESS Options: Open Directory Access: 00100001 9:25:24 AM aspnet_wp.exe:2256 DIRECTORY C:\sox\ NO SUCH FILE FileBothDirectoryInformation: sox.exe "* 9:25:24 AM aspnet_wp.exe:2256 CLOSE C:\sox\ SUCCESS 9:25:24 AM aspnet_wp.exe:2256 OPEN C:\ SUCCESS Options: Open Directory Access: 00100001 9:25:24 AM aspnet_wp.exe:2256 DIRECTORY C:\ SUCCESS FileBothDirectoryInformation: sox 9:25:24 AM aspnet_wp.exe:2256 CLOSE C:\ SUCCESS 9:25:24 AM aspnet_wp.exe:2256 OPEN C:\sox\ SUCCESS Options: Open Directory Access: 00100001 9:25:24 AM aspnet_wp.exe:2256 DIRECTORY C:\sox\ SUCCESS FileBothDirectoryInformation: sox.exe 9:25:24 AM aspnet_wp.exe:2256 CLOSE C:\sox\ SUCCESS it simply says no such file when it tries to access a file i know is there. the aspnet account has full control in that directory. this is from my local machine that has the same problem, but is win xp with iis 5.1 the code ran perfectly on a win2k box with iis 5.0. Could running the application pool with the Local Service account cause a problem in our production environment?
running as local service is generally descouraged since it grants full access priviledges if IIS is compromised. Why, does everything work if you're running as local service? Also, I didn't see any access denied errors in your FileMon output there, have you looked at RegMon? Maybe the process is trying to access the registry and being denied access.
Mark's blog: developMENTALmadness.blogspot.com
-
running as local service is generally descouraged since it grants full access priviledges if IIS is compromised. Why, does everything work if you're running as local service? Also, I didn't see any access denied errors in your FileMon output there, have you looked at RegMon? Maybe the process is trying to access the registry and being denied access.
Mark's blog: developMENTALmadness.blogspot.com
I checked and everything's running as a Network Service. i was told the other settings have been tried but none work, and inputting a username and password caused IIS to say the site was unavailable. here's the only access denied entries i found in regmon after i tried to execute sox.exe from our web app. 26.33727455 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer ACCESS DENIED Access: 0x1 DEVELOPMENT2\IUSR_DEVELOPMENT2 ...there were a bunch in here, a few not founds and no more entries... 26.33812141 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ACCESS DENIED Access: 0x20019 DEVELOPMENT2\IUSR_DEVELOPMENT2 26.33816528 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ACCESS DENIED Access: 0x20019 DEVELOPMENT2\IUSR_DEVELOPMENT2 and no access denied errors in filemon. and again these are on my local machine with win xp and iis 5.1..i'm going to try to run these on the production server, but i'm not sure how that will turn out.
-
I checked and everything's running as a Network Service. i was told the other settings have been tried but none work, and inputting a username and password caused IIS to say the site was unavailable. here's the only access denied entries i found in regmon after i tried to execute sox.exe from our web app. 26.33727455 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer ACCESS DENIED Access: 0x1 DEVELOPMENT2\IUSR_DEVELOPMENT2 ...there were a bunch in here, a few not founds and no more entries... 26.33812141 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ACCESS DENIED Access: 0x20019 DEVELOPMENT2\IUSR_DEVELOPMENT2 26.33816528 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ACCESS DENIED Access: 0x20019 DEVELOPMENT2\IUSR_DEVELOPMENT2 and no access denied errors in filemon. and again these are on my local machine with win xp and iis 5.1..i'm going to try to run these on the production server, but i'm not sure how that will turn out.
If you try to use a specific user account you will need to grant the proper access to that account. Namely, access to asp.net temp directory in the framework directory (c:\windows\microsoft.net\framework\vx.xxx\Temporary ASP.NET Files). Also your application directories and any other resources used by the application, including registry keys. Granting access to the asp.net temp directory and assigning the account to the IIS_WPG should cover the basic stuff and then you'll just need to make sure your application settings are correct. Here's an article on IIS_WPG[^] Otherwise, your site won't work as you have already discovered. Have you tried using Local System to see if that corrects the problem? If it does you could compare the errors you're getting with success entries to see where the difference is and track down the issue that way.
Mark's blog: developMENTALmadness.blogspot.com
-
I checked and everything's running as a Network Service. i was told the other settings have been tried but none work, and inputting a username and password caused IIS to say the site was unavailable. here's the only access denied entries i found in regmon after i tried to execute sox.exe from our web app. 26.33727455 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer ACCESS DENIED Access: 0x1 DEVELOPMENT2\IUSR_DEVELOPMENT2 ...there were a bunch in here, a few not founds and no more entries... 26.33812141 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ACCESS DENIED Access: 0x20019 DEVELOPMENT2\IUSR_DEVELOPMENT2 26.33816528 aspnet_wp.exe:2256 OpenKey HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ACCESS DENIED Access: 0x20019 DEVELOPMENT2\IUSR_DEVELOPMENT2 and no access denied errors in filemon. and again these are on my local machine with win xp and iis 5.1..i'm going to try to run these on the production server, but i'm not sure how that will turn out.
Also, have you looked into this: http://support.microsoft.com/kb/555134[^]?
Mark's blog: developMENTALmadness.blogspot.com
-
Also, have you looked into this: http://support.microsoft.com/kb/555134[^]?
Mark's blog: developMENTALmadness.blogspot.com
Thanks for the info, we have another solution we're going to try to see if it helps, if we stop and start that IIS Admin service i assume it'll stop and start all of the websites correct? We currently use Process.Start, i think we're going to try declaring a Process object and a ProcessInfo(not sure of the exact name) object and settings createnowindow = true and shellexecute= false, it works for us other places, mainly in applications where we dont want the screen to flicker when it uses the same application. if you can think of a reason this wouldnt help please let me know. I do appreciate all your help so far.
-
Thanks for the info, we have another solution we're going to try to see if it helps, if we stop and start that IIS Admin service i assume it'll stop and start all of the websites correct? We currently use Process.Start, i think we're going to try declaring a Process object and a ProcessInfo(not sure of the exact name) object and settings createnowindow = true and shellexecute= false, it works for us other places, mainly in applications where we dont want the screen to flicker when it uses the same application. if you can think of a reason this wouldnt help please let me know. I do appreciate all your help so far.
Yes, restarting IISAdmin restarts all web sites as well as their corresponding application pools. It should certainly help, let us know if your solution works for the benefit of others who experience the same issues.
Mark's blog: developMENTALmadness.blogspot.com
-
Yes, restarting IISAdmin restarts all web sites as well as their corresponding application pools. It should certainly help, let us know if your solution works for the benefit of others who experience the same issues.
Mark's blog: developMENTALmadness.blogspot.com
I always try to, my boss is currently writing a util class to run this app so we only have to change it in one place (the orig dev on this site wasnt very forward thinking). I'll let you know how we manage to fixit. I get to go play with VS2008 now.
-
I always try to, my boss is currently writing a util class to run this app so we only have to change it in one place (the orig dev on this site wasnt very forward thinking). I'll let you know how we manage to fixit. I get to go play with VS2008 now.
I tried the Interact with Desktop checkbox, and restarted the services, but i'm still getting the same problem..we havnt had time to try the other method of starting the process, any other ideas...i'm giving the IUSR account and some others access to the directory that contains the program but i dont know if that will help with 2003, it did with 2000
-
Yes, restarting IISAdmin restarts all web sites as well as their corresponding application pools. It should certainly help, let us know if your solution works for the benefit of others who experience the same issues.
Mark's blog: developMENTALmadness.blogspot.com
We were running the App pool with Network Service set, we needed to create another app pool (someone changed the user under the "Configurable" selection so we didnt have the corect Password for the IWAM_ account), in the new app pool we set the identity to configurable which was prepopulated with the IWAM_ account, and gave the IIS_WPG group write access to the directory the files are created in, and everything worked...We also have the Interact with desktop option on for the IIS Admin service, we're going to try turning that off tonite. Hope this helps someone, feel free to contact me if you have any questions, Thanks for your help Mark.