RE: asp.net and IIS 6, access denied to the web directory.

From: Chris Cichocki (chris.cichocki_at_newsgroup.nospam)
Date: 10/19/05 

Date: Wed, 19 Oct 2005 11:43:03 -0700

Have you tried granting read/execute permissions to the Users or Everyone
groups? This will tell you whether or not it is a membership issue. In
other words, if allowing these groups (only add one at a time) causes the
application to work, then there is something strange going on with the
identities not belonging to the groups you think they do.

We have had a similar problem where we set up a base machine with IIS
installed, then cloned it to create other machines. The Intenet Guest
Account was still named after the name of the base machine, and granting
explicit permissions to this account had absolutely no affect. Granting
permissions to the Users group (of which all local accounts are automatically
a member of) worked... The fix was to remove IIS and reinstall it, which
recreated the Internet Guest Account.

Chris

"Slim" wrote:

> Ok. Lets say I am running website called dev.mysoftware.com.
>
> In IIS, I have home directory set to C:\Inetpub\wwwroot\dev.mysoftware.com
> When I open the site, I get the error:
> ==================================================
> Server Error in '/' Application.
> --------------------------------------------------------------------------------
>
> Access to the path "C:\Inetpub\wwwroot\dev.mysoftware.com" is denied.
> Description: An unhandled exception occurred during the execution of the
> current web request. Please review the stack trace for more information about
> the error and where it originated in the code.
>
> Exception Details: System.UnauthorizedAccessException: Access to the path
> "C:\Inetpub\wwwroot\dev.mysoftware.com" is denied.
>
> ASP.NET is not authorized to access the requested resource. Consider
> granting access rights to the resource to the ASP.NET request identity.
> ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or
> Network Service on IIS 6) that is used if the application is not
> impersonating. If the application is impersonating via <identity
> impersonate="true"/>, the identity will be the anonymous user (typically
> IUSR_MACHINENAME) or the authenticated request user.
>
> To grant ASP.NET write access to a file, right-click the file in Explorer,
> choose "Properties" and select the Security tab. Click "Add" to add the
> appropriate user or group. Highlight the ASP.NET account, and check the boxes
> for the desired access.
> =====================================================
>
> I have searched and searched, and read that this is due to the anonymous
> user, aspnet user, machine service not having the permissions on the
> dev.mysoftware.com directory. I have followed all info I can find, and have
> set the permissions, but still getting the same error, and don't know what to
> try next....
>
> This is what I have so far. Anonymous Access is set to use user name:
> (IUSR_US-PORT). Application pool identity is Predefined: Network Service.
>
> On "C:\Inetpub\wwwroot\dev.mysoftware.com directory":
> ASP.NET Machine Account, IIS_WPG, IUSR_US-PORT, Network Service all have
> Read&Execute, List Folder Contents, Read permissions.
>
> On "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files"
> directory:
> ASP.NET Machine Account, IIS_WPG, IUSR_US-PORT, Network Service all have
> Full Control permission.
>
> Any other ideas to try? Please let me know if you need more detailed
> information about anything, but I am just stuck.
>
> Thanks all.
>
>

Relevant Pages

  • Re: generating MS-Excel report through ASP.Net without installing
    ... but adding "MACHINENAME\ASPNET" account to the MS Office ... execute permission may help. ... > permissions through DCOMCNFG for MSExcel application. ... > current web request. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: A question from a newbie
    ... roles are fine if these meet your security requirements. ... permissions to individual users or user-defined roles is appropriate when ... you need more granular security and/or stored procedure execute permissions. ... Utility scripts can be faster than granting permissions via Enterprise ...
    (microsoft.public.sqlserver.security)
  • Re: deny delete folders/files from a shared folder on the network
    ... If in the NTFS you do limit their ability to delete folders, ... their permissions to do so with files (which you can do by granting ... Administrators Full for "This folder, ... That is an issue that is part and parcel with granting Modify ...
    (microsoft.public.security)
  • Re: Do I need desecure the DB before I secure it again?
    ... Have you tried granting full permissions to all objects to the 'user' ... Regards, ...
    (microsoft.public.access.security)
  • Re: Revoking public permissions
    ... My recommendation would be to leave the system tables alone. ... are any security holes that turn up that arise from granting ... permissions to public, then they'll probably be addressed in a service ...
    (microsoft.public.sqlserver.security)