Re: asp/xml security problem in IIS

From: Karl Levinson [x y] mvp (levinson_k@excite.com)
Date: 12/04/02 

From: "Karl Levinson [x y] mvp" <levinson_k@excite.com>
Date: Wed, 4 Dec 2002 11:50:35 -0500

"jt" <jtingres@comcast.net> wrote in message
news:tuSdnURaafHOq3GgXTWcpg@comcast.com...
> We have an asp page that uses xml to get information from another
database.
> The problem is since we did some microsoft updates, only administrators on
> the box can see the webpage. All other users on the domain can not see the
> page the xml fails. IUSR has the proper rights on the folder and we have
> lowiis and anoymous checked. Can anyone think of what the problem could
be.
> Thanks

Well, I suppose you could enable auditing on the web server and/or database
server. It could be that the account you think is being used is not the one
being used. As you may know, if the folder containing the .ASP script is
set to Medium or High "Application Isolation" in the IIS MMC, then the
IWAM_computername account is being used instead of IUSR.

More info:

http://securityadmin.info/faq.htm#auditing
http://securityadmin.info/faq.htm#iwam

Or, it could be that the password for the IUSR account [or whichever account
is used to access the database] has changed either on the web server because
the IIS MMC is set to control the password, or on the SQL server because a
SQL or other patch was installed. This would probably be apparrent after
you enable auditing. You could confirm whether this is the case by trying
to log into windows on the web server using the IUSR account and the
password you think is assigned to the IUSR account, or by using the
ADSUTIL.VBS command to retrieve or set the password for the IUSR or IWAM
account in the IIS metabase. More information on using ADSUTIL can be found
by searching www.microsoft.com/support for the word ADSUTIL.

Relevant Pages

  • RE: Problems with WebParts
    ... to a database called aspnetdb. ... > The connection string specifies a local SQL Server Express instance using a ... > server account must have read and write access to the applications directory. ... > This is necessary because the web server account will automatically create ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Database connection
    ... configure your worker process identity to a custom account (via the AppPool ... create a "mirrored" account for the app pool account on the sql box ... > connect to an MS SQL2000 database. ... > The web server is NOT part of the domain, but can talk to my database ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: asp/xml security problem in IIS
    ... Use a domain account as anonymous user (the IUSR account is completely ... > is used to access the database] has changed either on the web server ...
    (microsoft.public.inetserver.iis.security)
  • Re: Concurrent Web- and direct access to an Access DB
    ... >> the folder containing the database. ... This includes the IUSR account. ... >> Bob Barrows ... This email account is my spam trap so I ...
    (microsoft.public.inetserver.asp.general)
  • Re: Concurrent Web- and direct access to an Access DB
    ... >> the folder containing the database. ... This includes the IUSR account. ... >> Bob Barrows ... This email account is my spam trap so I ...
    (microsoft.public.inetserver.asp.db)