Re: IIS6 + ISAPI Filter + Application Pool Identity problem

From: LF (lf_at_nospam.nospam)
Date: 01/20/05 

Date: Wed, 19 Jan 2005 21:02:38 -0500

> Finally, if IIS attempts to load a filter and it fails, it will always log
> an event.

I don't think it's being loaded at all. I have source for the filter. I also
created a filter that doesn't do anything at all. What can cause IIS6 not to
load filter at all? I responded to the other post. If you could, please
refer to that post. Thank you very much for your reply

"Wade A. Hilmo [MS]" <wadeh@microsoft.com> wrote in message
news:%23JaOoff$EHA.2584@TK2MSFTNGP09.phx.gbl...
> Hi LF,
>
> To satisfy IIS's requirements, the account must be a member of the IIS_WPG
> group. Since requests are being served, it sounds like this has been
> done.
>
> The filter itself may have its own requirements, depending on what it
> does,
> how it's ACLed, etc. It's possible that the filter calls some API or
> accesses some object that requires a high privilege. The only way to
> determine the requirements for sure, is to contact the vendor for the
> filter. If you are the developer for the filter, then you will need to
> run
> it under a debugger to determine why it's failing.
>
> Finally, if IIS attempts to load a filter and it fails, it will always log
> an event. Since it's working when the app pool is running with high
> privilege, we can assume that it's installed correctly. Therefore, if a
> failure occurs when IIS attempts to call LoadLibraryExW on it, or if it's
> GetFilterVersion returns FALSE, an event will be logged with the Win32
> error
> code as the data for the event. If no event is getting logged, then it
> sounds like the filter is loading, but it is not doing what you expect due
> to some privilege issue as above.
>
> I hope that this helps to point you in the right direction.
>
> Thank you,
> -Wade A. Hilmo,
> -Microsoft
>
> "LF" <lf@nospam.nospam> wrote in message
> news:uSwluAe$EHA.2572@tk2msftngp13.phx.gbl...
>> Hi,
>>
>> What permissions are required from an account that is used for
>> Application
>> pool in IIS6 so that ISAPI filter works properly? I created a normal User
>> account on AD. I configured Application pool according to:
>>
> http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/standard/proddocs/en-us/sec_acc_wpenable.asp
>>
>> Evrything works fine. I can access the ASP.NET related content. Now I
>> also
>> want to use an ISAPI filter for the whole web site. It completely fails
>> to
>> load. No errors, no security audits. If I add that User account to
>> Administrators, everything is fine, ISAPI filter is loaded and works. If
>> I
>> use default Network Service account, everything works fine also.
>>
>> My question is: What permissions are required from account used in
>> Application Pool, so that ISAPI filter can be loaded by IIS6 and work
>> properly?
>>
>> Thank you for any help on this
>>
>>
>>
>
>

Relevant Pages

  • IIS 6 / ISAPI filter loading behavior inconsistency - Windows Server 2003
    ... I'm receiving inconsistent behavior when I try to load an in-house written ... ISAPI filter under IIS 6. ... We have three identical machines running Windows ...
    (microsoft.public.inetserver.iis)
  • Re: Mustang GT and K&N air charger
    ... The ECU has load tables that it uses to help calculate what ... operator to keep the filters fresh and a dirty air filter makes the ECU ... the throttle position sensor is the only sensor that will even show a minor variation as a result of a change in air filter restriction. ... Is it your claim that this small change is going to upset the PCM so much that it can't maintain the proper fuel to air ratio? ...
    (rec.autos.makers.ford.mustang)
  • Re: where is it hiding?
    ... processed without the filter loaded. ... The messages that you see in the UrlScan log are just there to indicate when ... Assuming that a filter is properly installed, it is possible for IIS to fail ... fail to load the filter prior to calling any entry points (due to ...
    (microsoft.public.inetserver.iis.security)
  • Re: Strain Gauges - Signal Conditioning with programmable gain
    ... At full positive load the output will be +10V and at full ... I will allow a reasonable amount of adjustment (say ... What I'm most worried about is the filter part. ... and then read the other one 10microseconds (100 kHz frequency) later. ...
    (sci.electronics.design)
  • RE: if recordset is empty, add new record
    ... In the load event it would something like: ... "SandyR" wrote: ... should change the filter property in the on load procedure, ...
    (microsoft.public.access.gettingstarted)