Re: Rights Problem with IWAM and IUSR Accounts

From: Tibor Biro (tiborbiro@rogers.com)
Date: 09/04/02 

From: "Tibor Biro" <tiborbiro@rogers.com>
Date: Wed, 4 Sep 2002 16:45:48 -0400

Make sure you also check the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

If CrashOnAuditFail is set to 2 then only administrators can login. 

--
Regards,
Tibor Biro
MCSE, MCDBA, MCSD
--------------------------------------
Please respond only to the Newsgroup and not directly to
me by email so that all may benefit from the information
"Tibor Biro" <tiborbiro@rogers.com> wrote in message
news:uBgGNEFVCHA.1668@tkmsftngp13...
> Are you able to interactively login with any user that is not part of the
> administrators group?
>
> Check the local policy settings and see what are the effective settings
for
> Logon Locally. Do you have any domain policies that restrict the logon for
> those users?
>
> You can also try to reset the local policy settings to the default values
by
> importing the "setup security" template.
>
> --
> Regards,
> Tibor Biro
> MCSE, MCDBA, MCSD
> --------------------------------------
> Please respond only to the Newsgroup and not directly to
> me by email so that all may benefit from the information
>
>
> "Chris Scipioni" <christopher.scipioni@usa.xerox.com> wrote in message
> news:ab8bdca5.0209041131.4466da38@posting.google.com...
> > Tibor,
> >
> > I removed and reinstalled IIS, removed Com+ and readded it back and
> > reinstalled the application and still had the same problem...Could not
> > load ASP pages unless I added IUSR and IWAM accounts to the
> > Administrator's group.  I built a 2nd Win2K server, installed IIS,
> > installed the application and it works fine.  I am now comparing
> > registry settings and permissions to see if I can find what is
> > different between the two.  Not having much luck so far, but
> > continuing to try.
> >
> > "Tibor Biro" <tiborbiro@rogers.com> wrote in message
> news:<#TsAkgkSCHA.1804@tkmsftngp13>...
> > > Hi there,
> > >
> > > Out of the box IIS 5 should be running ASP with ADO without any
> problems. If
> > > you lost track of the configuration changes maybe you should
> > > uninstall/reinstall IIS. Also make sure that users that are not
members
> of
> > > the administrators group can  login interactively, if they can't it is
a
> > > simptom for greater trouble.
> > >
> > > Regards,
> > > Tibor Biro
> > >
> > > "Chris Scipioni" <christopher.scipioni@usa.xerox.com> wrote in message
> > > news:ab8bdca5.0208221201.1afb6150@posting.google.com...
> > > > I am running IIS 5 on a Windows 2000 server and I have a rights
> > > > problem with the IWAM_server and IUSR_server accounts.  The initial
> > > > problem was that I could not load any ASP pages, .htm pages loaded
> > > > fine.  I came across
http://www.iisfaq.com/default.asp?View=A463&P=170> > > > which I followed through step by step.
> > > >
> > > > I switched the application protection from high/middle to low and
was
> > > > able to load ASP pages ok, but then got VBScript runtime error
> > > > (0x800A01AD) when running the web application.  The ASP page was
> > > > trying to do a Server.CreateObject("ADODB.Recordset").  I found
> > > > another link which stated that error is most likely due to
permissions
> > > > problems with the IWAM user also.  Bottom line is that I have gone
> > > > through many error messages and all solutions/fixes have pointed to
a
> > > > problem with permissions on IWAM/IUSR.
> > > >
> > > > I 'fixed' the problem temporarily by adding the IWAM_server and
> > > > IUSR_server users to the Administrators group.  My question is
> > > > this...How can I set the permissions for the IWAM and IUSR accounts
> > > > correctly, once and for all, so that I can remove the Administrators
> > > > group access?
> > > >
> > > > Thanks ahead of time for any info!
>
>

Relevant Pages

  • Re: Two DB Owners
    ... impede Microsoft Windows NT system administrators from having system ... I'd like to remove all permissions from the admins ... When I remove the login it doesn't ...
    (microsoft.public.sqlserver.security)
  • Re: Broadcast Publishing Point Not Working
    ... You can see that the Administrators ... >>are having pushing Media to the Windows Media Streaming ... >>We have no Authentication Methods set and as I understand ... >>it does not login. ...
    (microsoft.public.windowsmedia.server)
  • Re: too many illegal connection attempts through ssh
    ... > IP address if it is attempting to guess my login usernames? ... administrators' tool that would work as follows. ... If it becomes apparent that the attacks are coming ... tool (on many hundreds of thousands of BSD machines). ...
    (freebsd-questions)
  • Windows 2000 SP2 local policy settings not stored using SIDs?
    ... Windows 2000 SP2 local policy settings not stored using SIDs? ... Rename the local administrators group to something besides ... TREND MICRO SCANMAIL FOR EXCHANGE 2000 -- SECOND to NONE ...
    (NT-Bugtraq)
  • HELP - no sa password "about to reinstall sql7"
    ... administrators will be sysadmins in SQL Server ... > login but you should refer to the following for more ... >>to access a database as the SQL 'sa' account. ...
    (microsoft.public.sqlserver.security)