Re: IISAPI Filter with IIS 6.0

From: Sreejith (anonymous_at_discussions.microsoft.com)
Date: 01/11/04 

Date: Sat, 10 Jan 2004 22:35:07 -0800

Thanks Wade,

I will try debugging the Filter.

Sreejith
>-----Original Message-----
>Hi Sreejith,
>
>If the ISAPI works correctly when you run in Worker
Process Isolation Mode,
>but only as local system, and it fails running as network
service, then
>you've pretty much narrowed down the issue to one of two
things.
>Specifically, the ISAPI is doing some operation that
requires the higher
>level of privileges associated with the local system
account; or, possibly,
>it's accessing some resource that allows local system but
not network
>service in an ACL.
>
>Your best course of action is to contact the vendor of
the application and
>see if they even support running on IIS 6. If you wrote
the ISAPI in house,
>then someone should run it under a debugger and find out
specifically where
>it's failing.
>
>You may be able to test for the latter case above by
turning on security
>auditing while running as network service and looking for
failures.
>Depending on what you find, you may be able to adjust the
ACLs, but there is
>no guarantee that this will be either feasible or
possible.
>
>If it turns out that the ISAPI is doing something that
requires local system
>privilege (ie. the SeTcbPrivilege in NT-security-speak),
then there is no
>way to configure around this. The ISAPI will need to be
modified.
>
>I hope that this helps,
>-Wade A. Hilmo,
>-Microsoft
>
>
>"Sreejith P S" <johndoe@nodomain.com> wrote in message
>news:08c701c3d45d$e504cd10$a501280a@phx.gbl...
>> Hi,
>>
>> We have an application which was working fine for
Windows
>> 2000 with IIS 5.0. We
>> deployed the same applicaton on Windows 2003 with IIS
6.0.
>> We get "Service Unavailable"
>> error when we run the application in the default app
pool
>> with Network Service as the user.
>>
>> If we run the same application as "Local System" user or
>> IIS 5.0 Isolation mode, it works fine.
>> We want to run our application as "Network Service" user
>> for DefAppPool.
>>
>> We tried to go through the documentation, mails on many
>> newsgroups. We could not find
>> any suitable solution for the same.
>>
>> We are using ISAPI filters. We presume that it works
fine
>> on IIS 6.0.
>> We are not using the following registers
SF_READ_RAW_DATA
>> or SF_SEND_RAW_DATA in our code.
>>
>> Any help on the same is appreciated.
>>
>>
>> Thanks in advance
>
>
>.
>

Relevant Pages

  • Re: IIS Isolation Mode
    ... We create some files and read some files in the ISAPI. ... something that requires local system privileges, and if it doesn't have it, ... would guess that the IIS 5 version will work correctly on IIS 6, since ADSI ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS Isolation Mode
    ... something that requires local system privileges, and if it doesn't have it, ... it causes the worker process to terminate. ... or it could mean that it exists the process hosting the ISAPI some ... would guess that the IIS 5 version will work correctly on IIS 6, ...
    (microsoft.public.inetserver.iis.security)
  • Re: IISAPI Filter with IIS 6.0
    ... If the ISAPI works correctly when you run in Worker Process Isolation Mode, ... level of privileges associated with the local system account; ... auditing while running as network service and looking for failures. ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS (or Isapi) adds Connection header to response
    ... I would never rely on a bug in a browser implementation as the means to get ... > I dont currently have access to the ISAPI code. ... available on any other IIS version. ... NTLM header since it is no longer useful. ...
    (microsoft.public.inetserver.iis.security)
  • Re: ISAPI vs. HTTPModule
    ... which parses the request and dispatches it to IIS in usermode. ... extension of the request is determined, and then sent to its handler. ... > ISAPI will not be able to access any .Net intrinsics/events. ...
    (microsoft.public.inetserver.iis)
Quantcast