Re: IIS 6 CreateObject premissions issue

From: Matthew Nichols (matthew_at_dreamteamtech.com)
Date: 10/18/04


Date: Mon, 18 Oct 2004 09:09:24 -0500

If I am getting your meaning correctly, I don't think so. If I run a vbs
script from the command line it that calls the object and requests data that
works fine.

Matthew

"[SteelValor]" <SteelValor@discussions.microsoft.com> wrote in message
news:217408E6-1D41-4414-8FE4-7A6674AA3F1B@microsoft.com...
> This is just a wild guess, but does line 23 call/include aother object
> that
> might not have the right permissions?? I've run into that on several
> occasions.
>
> "Matthew Nichols" wrote:
>
>> First off I apologize for the crucial piece of information I will
>> doubtlessly leave out (don't know what it is but I am sure there will be
>> something) or the completely obvious answer that I have missed.
>>
>> We have a system that has been running on Windows 2000 Server composed of
>> SQL / COM+ / ASP layers. It currently runs as a single physical tier
>> system
>> in our production environment, but it is tested as both a single and dual
>> tier system so I am confident that running on Windows 2000 what I am
>> attempting works.
>>
>> What I am attempting is to add a Windows 2003 server box to function as
>> the
>> IIS server and use COM+ proxies to hook back to the COM+ running on the
>> backend so we can stop running the single server so hard. As I said this
>> works in the QA environment on Windows 2000 server just fine.
>>
>> If IIS is set to not allow anonymous access then I am able to log in and
>> the
>> system runs fine. However if it is set for anonymous access using the
>> IUSR
>> account then I receive the following error:
>> Server object error 'ASP 0178 : 80070005'
>> Server.CreateObject Access Error
>> /scripts/include/organization.asp, line 23
>> The call to Server.CreateObject failed while checking permissions. Access
>> is
>> denied to this object.
>>
>> I have of course seen a number of postings with this error and have tried
>> a
>> number of their suggestions. I have tried:
>> - setting the anonymous account to domain account with admin privileges
>> (this interestingly attempts to force the user to login even though
>> anonymous is allowed).
>> - giving admin privileges to the IUSR and IWAM accounts
>> - setting the default COM access and launch permissions on front and back
>> end boxes to specifically allow the Domain account I attempted to use as
>> well as the IUSR and IWAM accounts
>> - adding the domain account to IIS_WPG group
>> - changing the Identity of the Default App Pool to all 3 predefined
>> identities as well as the domain account and the IWAM account
>> - disabling security on the COM+ Application packages.
>>
>> and another of other things that are now escaping me. I am clear that I
>> have
>> been trying all that I can think of but alas I am not a trained admin but
>> rather an applications programmer trying to figure it out.
>>
>> What I am hoping for in my posting is that someone will be able to say
>> whether or not it is even possible configuration given the different OSs
>> involved and if there is some clear thing that I have missed given what I
>> have mentioned. I have not seen mention of anyone attempting this
>> particular
>> configuration so any direction would be very much appreciated.
>>
>> Thanks,
>>
>> Matthew Nichols
>>
>>
>>



Relevant Pages

  • Re: IIS6 Basic Authentication and Kerberos
    ... access the site is a Domain Account on my Windows 2003 domain. ... The IIS server ... Someone types in the wrong password for the domain account used to login ... On the web server a security event log is logged. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Win98 clients cant change password
    ... attention to anonymous access - it can not be set to explicit permissions. ... >> Windows 2000 server CD. ... >>> Ron Lounsbury ...
    (microsoft.public.win2000.security)
  • Re: Domain admin cannot run program on SBS Domain Controller
    ... server. ... I get an error "Windows cannot access the specified device path ... logged on with my domain account, and my account is a member of the Domain ...
    (microsoft.public.windows.server.sbs)
  • RE: Virus is getting domain account listing
    ... and valid value in Windows 2000. ... For Windows Server 2003, I'd recommend inspecting the available Group Policy ... Virus is getting domain account listing ...
    (Focus-Microsoft)
  • Re: Local / Roaming Protocol
    ... Please visit the server experts in the server newsgroup: ... Get Windows XP Service Pack 2 with Advanced Security Technologies: ... | roaming profile and then for a local user profile. ... | my domain account. ...
    (microsoft.public.windowsxp.security_admin)