Re: IIS 5.0 password protected website problem

From: Tom Kaminski [MVP] ((A_at_T))
Date: 09/04/03 

Date: Thu, 4 Sep 2003 09:12:16 -0400

"Tom Kaminski [MVP]" <tomk (A@T) mvps (D.O.T) org> wrote in message
news:bj7d9l$1gv6@kcweb01.netnews.att.com...
> "Steve Holland" <holland_s@hotmail.com> wrote in message
> news:eTPbkNscDHA.456@TK2MSFTNGP10.phx.gbl...
> > Hi all,
> >
> > We are experiencing a strange problem with all websites we password
> protect.
> > We have a win2k/IIS5 server which we host test versions of websites we
> > develop. All of the sites are password protected, using folder security.
> We
> > removed IUSR account and added a locally created user, in IIS, on the
> > 'Directory Security' tab of properties, we click 'anonymous access and
> > authentication control', in here 'Anonymous Access' and 'Basic
> > Authentication' are the only two options checked (not all of our users
use
> > IE). This all works fine, users browses to page, asked to login, enter
> > correct details, in they go. The problem which we have is that the
website
> > is written in ASP and uses a global.asa to provide some Application
Level
> > variables, namely the database connection string. What seems to happen
is
> > that intermittently these variables seem to disappear from memory, thus
> > breaking the site (can't connect to db). This problem only occurs on
> > websites which are password protected. The exact same website located on
a
> > development server or on the live server never suffers from this
problem.
> We
> > have tried password-protecting websites on other servers and the same
> > problem occurs so its not a problem with the machine itself.
> >
> > I've never seen this problem before (it didn't seem to happen on
WinNT4).
> > It's either a problem with the way we are setting up the password
> > protecting, or its a MS bug, either way its causing us a lot of problems
> and
> > we'd like to fix it one way or another. If any out there has seen this
> > before and knows a fix, or a better way of password-protecting sites I'd
> be
> > very happy to hear from you.
>
> You're not crazy - I've seen the same exact thing happen and have never
> received an explanation from MS. It was happening quite a bit about 8
> months ago and I got it to stop but I can't remember what I did to fix it.
> Coincidentally, it just happened on a different web the other day. I
opened
> global.asa and made a minor insignificant change (added a space char
> somewhere) and it's been working the rest of the week.

After reviewing my notes - are you using the local IWAM account or have you
switched to a domain account?

Is this kind of what you're seeing?
http://support.microsoft.com/default.aspx?scid=kb;en-us;173742 

-- 
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/

Relevant Pages

  • Jim Gamble expands his empire to social websites
    ... 'NAME AND SHAME' PLAN FOR WEBSITES ... Websites that fail to protect children from sexual predators could ... Mr Gamble said the "report abuse" button was part of the centre's ...
    (uk.legal)
  • Re: IIS 5.0 password protected website problem
    ... protect. ... > We have a win2k/IIS5 server which we host test versions of websites we ... > development server or on the live server never suffers from this problem. ... > we'd like to fix it one way or another. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Graphics generation and website protection.
    ... I have noticed that a number of websites, ... allow readers to comment on articles, protect themselves from ... automated responders by generating a graphic image of random numbers ...
    (microsoft.public.dotnet.framework.aspnet.webcontrols)
  • Re: Graphics generation and website protection.
    ... I have noticed that a number of websites, ... allow readers to comment on articles, protect themselves from ... automated responders by generating a graphic image of random numbers ...
    (microsoft.public.dotnet.framework.aspnet.webcontrols)
  • Re: How to securely store a password on a PC
    ... password - so locking the data to ONE account will not solve that problem. ... Full disk encryption can protect against EXTERNAL attackers (who ... full encryption - not only Vista's BitLocker but any 3rd party solution. ... Security is not about the secrecy of the algorithm. ...
    (microsoft.public.platformsdk.security)