Rights Problem with IWAM and IUSR Accounts

From: Terry (junkbait@attbi.com)
Date: 08/23/02 

From: "Terry" <junkbait@attbi.com>
Date: Fri, 23 Aug 2002 11:30:34 -0700

The problem sound like debug does not have have
permissions in dcom. Make the following registry settings.
Place the following in a .reg file. If you don't know why
you put it into the .reg file. Don't do any of this and
find an MCP
regedit4
[HKEY_CLASSES_ROOT\CLSID\{70F214BA-94E2-4bdf-8F30-
32CB4A905E4D}]
@="VB ASP Debugging"
[HKEY_CLASSES_ROOT\CLSID\{70F214BA-94E2-4bdf-8F30-
32CB4A905E4D}\LocalServer32]
@="vb6.exe"
[HKEY_CLASSES_ROOT\AppID\vb6.exe]
"AppId"="{70F214BA-94E2-4bdf-8F30-32CB4A905E4D}"

Then START|RUN Domcnfg.exe to start the decom config
properties editor. Choose Default properties tab and
select ENABLE COM Internet Services on this computer.

Then go to the Default Security tab and choose Default
Access Permissions and the Edit Default button. Add the
IUSR_ServerName account and the Interactive account, and
type of access allow.

Whoops I forgot also go to Applications, choose VB Asp
debugging properties and and give the everyone account
permission.

Check to make certain the IUSR account has default launch
permissions while you are there. Choose apply OK,
whatever, and you will have to reboot
 

>-----Original Message-----
>I am running IIS 5 on a Windows 2000 server and I have a
rights
>problem with the IWAM_server and IUSR_server accounts.
The initial
>problem was that I could not load any ASP pages, .htm
pages loaded
>fine. I came across http://www.iisfaq.com/default.asp?
View=A463&P=170
>which I followed through step by step.
>
>I switched the application protection from high/middle to
low and was
>able to load ASP pages ok, but then got VBScript runtime
error
>(0x800A01AD) when running the web application. The ASP
page was
>trying to do a Server.CreateObject("ADODB.Recordset"). I
found
>another link which stated that error is most likely due
to permissions
>problems with the IWAM user also. Bottom line is that I
have gone
>through many error messages and all solutions/fixes have
pointed to a
>problem with permissions on IWAM/IUSR.
>
>I 'fixed' the problem temporarily by adding the
IWAM_server and
>IUSR_server users to the Administrators group. My
question is
>this...How can I set the permissions for the IWAM and
IUSR accounts
>correctly, once and for all, so that I can remove the
Administrators
>group access?
>
>Thanks ahead of time for any info!
>.
>

Relevant Pages

  • Re: FolderExists and UNC path
    ... Traditionally ASP uses the IUSR_account so try mapping a drive using that username and password or assigning permissions to that account or changing to a different one if you don't know or can't change the password. ... When I ran this command from the server logged with my user it ...
    (microsoft.public.scripting.vbscript)
  • Re: IUSR_myserver and deny write
    ... your configuration is the default from Microsoft. ... ran your ASP page... ... All run IIS under the NT AUTHORITY\Network account. ... IUSER_on the wwwroot directory has no read permissions. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Incoming E-Mail - cant create contact in OU
    ... account out of local administrator to attempt to find any denied access. ... I then added full permissions to my user account on both of these keys, ... local admin rights to the server hosting incoming email. ... what permission I need to give the app pool locally to avoid this issue. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Incoming E-Mail - cant create contact in OU
    ... account out of local administrator to attempt to find any denied ... I then added full permissions to my user account on both of these keys, ... that's for every app pool you create for every new web app on the ... local admin rights to the server hosting incoming email. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Win2k - Account Operator not working properly
    ... You very likely have other ACL issues other than what was mentioned and I can point them out here for you for free or you can pay someone $200-500 an hour to come check it out. ... In order for that to result in inheritence protection it means the schema had to be modified. ... set the account in the GUI to inherit from its parents. ... Used the delegation wizard, on the top level OU, to assign the desired permissions. ...
    (microsoft.public.windows.server.active_directory)