Re: machine.config - add assembly="*" - Required permissions cannot be acquired - IIS 6.0 - c#

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Kal (kal_at_newsgroup.nospam)
Date: 03/15/05 

Date: Mon, 14 Mar 2005 22:39:33 -0800

Steven, good morning,
Regarding IWAM_SANDBOX, it was one of the choices in the identity drop down
list and I tried them all. As I recall, the other one was Local Service.

Regarding WSS - I have not yet worked with that and believe no website is
extended by WSS, but would not necessarily recognize it if it was. What are
the symptoms?

I did install filemon and most of the errors were coming from directories
within winnt. I made some changes and it did not clear up even with what
were probably excessive permissions that, of course, rippled through the
directory. It seemed the chances of my screwing it up permanently were
significant, and I blew the whole thing clean and started over.

In a few days when I get it reorganized we will know if there is an ongoing
issue. This time I am not going to install SQL Reporting until after Visual
Studio is fully functional. Is there a white paper on how to do this setup
without stress or pain? I have a few web servers to upgrade in due course.
All were fresh installs of W2K when they were young. They run a mix of asp
and .net.

Kal

"Steven Cheng[MSFT]" <v-schang@online.microsoft.com> wrote in message
news:rCy2m7FKFHA.3132@TK2MSFTNGXA02.phx.gbl...
> Thanks for your followup Kal,
>
> As you said that the when switching the process Identity to LOCAL SYSTEM,
> it works( Do you mean that the applicaiton will run without any permission
> problem with both the two applications?), I think this is like a typical
> permission issue. LOCAL SYSTEM is the most powerful identity for running
> ASP.NET.
>
> What makes me a bit confused is that why did you choose the "
> IWAM_SANDBOX"
> or "LocalService" account to run the ASP.NET? On w2k3 server with IIS6(if
> not using the IIS5 MODEL), the default process Identity will be NT
> AUTHORITY\NetworkService (also the comupter's network account), also we
> can
> switch to LOCALSYSTEM if want unrestricted permission on local machine.
> But
> the IWAM_SANDBOX or LocalService account are not the recommended process
> Identity account which may not have the sufficient permissions for running
> ASP.NET.
>
> In fact, on 2k3server with IIS6, you can find a local Group named
> "IIS_WPG"
> which is the group for the ASP.NET process Account. So I suggest you
> create
> a new account (LOCAL or domain) and add this account into the IIS_WPG
> group(Networkservice is by default in this group). This will ensure the
> account will have the sufficient permissions to run ASP.NET normally.
> Then, you can switch your asp.net application's Applicaiton Pool to use
> this account to see whether the permission error still occurs.
>
> If still with permission error, I suggest you use the FILE monitor tool to
> have a check to see what's the exact file that cause this error so that we
> can try granting permission to our process identity.
>
> BTW, since WSS is by default installed on SBS , is your website be
> extended
> by WSS? Runing normal asp.net application in a site which has been
> extended
> by WSS will also cause permission problems.
>
> If any questions on this, please feel free to post here. Thanks,
>
>
> Steven Cheng
> Microsoft Online Support
>
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>
>
>
>
>

Relevant Pages