IIS 5.0 and ASP 2.0

[DTM]

We have a win2k with SP4 running IIS5. We have Framework v2.0.507277
installed and looking run an application in ASP 2.0. We are having troubles
because the default user is IWAN which doesn't have the correct permissions
to run an ASP 2.0 application. How do we run this new application pool under
Network Service or is there a different way to grant the correct permissions
to make our application run.



Thanks,

 

[Juan T. Llibre]

re:

How do we run this new application pool under Network Service

The Network Service account is specific to IIS 6.0.
I don't think you can create a Network Service account under IIS 5.x.

re:

is there a different way to grant the correct permissions to make our application run

The best way to grant the correct permissions for 2.0 is :

aspnet_regiis -GA machinename\accountname
or
aspnet_regiis -GA domainname\accountname

Alternately, you can manually grant whichever account you're
running ASP.NET as, the permisions which this article enumerates :

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx

 

[DTM]

Juan,

Here is the error I get in Event Viewer when trying to run our application.
How to a grant ASP.NET user 'read' permissions to the GAC?


Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/19/2006
Time: 9:37:32 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does not
have read permissions to the global assembly cache. Error: 0x80070005 Access
is denied.

Thanks,

 

[Juan T. Llibre]

You can't set permissions on the GAC directory via Windows Explorer.

Use a commandline utility called CACLS.

Open up a command window and run the following command :
CACLS %WINDIR%\assembly /e /t /p [DOMAIN|MACHINENAME]\useraccount:R

....substituting either your domain name (for a domain account) or machine name (for a local
account).

For example :
CACLS %WINDIR%\assembly /e /t /p MACHINENAME\account:R
or
CACLS %WINDIR%\assembly /e /t /p DOMAINNAME\useraccount:R

It *must* be the account ASP.NET is running as...

 

[Juan T. Llibre]

Hmmm, now that I recall, isn't the GAC on W2K located at c:\winnt\assembly\gac ?

Where are all your GAC assemblies located ?

In c:\winnt\assembly

or in :

c:\winnt\assembly\gac

???

Hi,

Well we tried your instructions and followed the steps from the "ASP.NET2.0 Troubleshooting.pdf"
but still can't get our app to run. We still get the same error in Event Viewer,



Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/21/2006
Time: 8:28:48 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does not have read permissions
to the global assembly cache. Error: 0x80070005 Access is denied.

This is the exact command we ran:



cacls c:\winnt\assembly /e /t /p cql-gr-st01\ASPNET:R



You can see that the user does have read access to assembly.



Any other ideas on this issue?

Thanks for your help.

You can't set permissions on the GAC directory via Windows Explorer.

Use a commandline utility called CACLS.

Open up a command window and run the following command :
CACLS %WINDIR%\assembly /e /t /p [DOMAIN|MACHINENAME]\useraccount:R

...substituting either your domain name (for a domain account) or machine name (for a local
account).

For example :
CACLS %WINDIR%\assembly /e /t /p MACHINENAME\account:R
or
CACLS %WINDIR%\assembly /e /t /p DOMAINNAME\useraccount:R

It *must* be the account ASP.NET is running as...

Juan,

Here is the error I get in Event Viewer when trying to run our application. How to a grant
ASP.NET
user 'read' permissions to the GAC?


Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/19/2006
Time: 9:37:32 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does not have read
permissions
to the global assembly cache. Error: 0x80070005 Access is denied.

Thanks,

re:
How do we run this new application pool under Network Service

The Network Service account is specific to IIS 6.0.
I don't think you can create a Network Service account under IIS 5.x.

re:
is there a different way to grant the correct permissions to make our application run

The best way to grant the correct permissions for 2.0 is :

aspnet_regiis -GA machinename\accountname
or
aspnet_regiis -GA domainname\accountname

Alternately, you can manually grant whichever account you're
running ASP.NET as, the permisions which this article enumerates :

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx





We have a win2k with SP4 running IIS5. We have Framework v2.0.507277 installed and looking
run
an application in ASP 2.0. We are having troubles because the default user is IWAN which
doesn't have the correct permissions to run an ASP 2.0 application. How do we run this new
application pool under Network Service or is there a different way to grant the correct
permissions to make our application run.



Thanks,

 

[DTM]

It's located c:\winnt\assembly\gac and I double checked and ASPNET has READ
access in that directory too.

Hmmm, now that I recall, isn't the GAC on W2K located at
c:\winnt\assembly\gac ?

Where are all your GAC assemblies located ?

In c:\winnt\assembly

or in :

c:\winnt\assembly\gac

???

Hi,

Well we tried your instructions and followed the steps from the
"ASP.NET2.0 Troubleshooting.pdf" but still can't get our app to run. We
still get the same error in Event Viewer,



Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/21/2006
Time: 8:28:48 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does
not have read permissions to the global assembly cache. Error: 0x80070005
Access is denied.

This is the exact command we ran:



cacls c:\winnt\assembly /e /t /p cql-gr-st01\ASPNET:R



You can see that the user does have read access to assembly.



Any other ideas on this issue?

Thanks for your help.

You can't set permissions on the GAC directory via Windows Explorer.

Use a commandline utility called CACLS.

Open up a command window and run the following command :
CACLS %WINDIR%\assembly /e /t /p [DOMAIN|MACHINENAME]\useraccount:R

...substituting either your domain name (for a domain account) or
machine name (for a local
account).

For example :
CACLS %WINDIR%\assembly /e /t /p MACHINENAME\account:R
or
CACLS %WINDIR%\assembly /e /t /p DOMAINNAME\useraccount:R

It *must* be the account ASP.NET is running as...






Juan,

Here is the error I get in Event Viewer when trying to run our
application. How to a grant ASP.NET
user 'read' permissions to the GAC?


Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/19/2006
Time: 9:37:32 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does
not have read permissions
to the global assembly cache. Error: 0x80070005 Access is denied.

Thanks,

re:
How do we run this new application pool under Network Service

The Network Service account is specific to IIS 6.0.
I don't think you can create a Network Service account under IIS 5.x.

re:
is there a different way to grant the correct permissions to make our
application run

The best way to grant the correct permissions for 2.0 is :

aspnet_regiis -GA machinename\accountname
or
aspnet_regiis -GA domainname\accountname

Alternately, you can manually grant whichever account you're
running ASP.NET as, the permisions which this article enumerates :

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx





We have a win2k with SP4 running IIS5. We have Framework v2.0.507277
installed and looking run
an application in ASP 2.0. We are having troubles because the
default user is IWAN which
doesn't have the correct permissions to run an ASP 2.0 application.
How do we run this new
application pool under Network Service or is there a different way to
grant the correct
permissions to make our application run.



Thanks,

 

[Juan T. Llibre]

re:

ASPNET has READ access in that directory

Reviewing your original post, you said that :

the default user is IWAN

I think you meant IWAM, right ?

You need to determine which is the account which ASP.NET is *actually* running as.

Please save this script as "identity.aspx" and run it.

identity.aspx :
--------------
<%@ Page Language="VB" %>
<%@ Import NameSpace = System.Security.Principal %>
<script runat="server">
Sub Page_Load()
Dim tmp As String = WindowsIdentity.GetCurrent.Name()
Label1.Text = tmp
End Sub
</script>
<html>
<head>
<title>WindowsIdentity.GetCurrent.Name()</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:Label ID="Label1" Runat="server" Text="Label"></asp:Label>
</div>
</form>
</body>
</html>
------------

Then, grant read permissions to whichever account the script returns.

It's located c:\winnt\assembly\gac and I double checked and ASPNET has READ access in that
directory too.

Hmmm, now that I recall, isn't the GAC on W2K located at c:\winnt\assembly\gac ?

Where are all your GAC assemblies located ?

In c:\winnt\assembly

or in :

c:\winnt\assembly\gac

???

Hi,

Well we tried your instructions and followed the steps from the "ASP.NET2.0 Troubleshooting.pdf"
but still can't get our app to run. We still get the same error in Event Viewer,



Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/21/2006
Time: 8:28:48 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does not have read
permissions to the global assembly cache. Error: 0x80070005 Access is denied.

This is the exact command we ran:



cacls c:\winnt\assembly /e /t /p cql-gr-st01\ASPNET:R



You can see that the user does have read access to assembly.



Any other ideas on this issue?

Thanks for your help.

You can't set permissions on the GAC directory via Windows Explorer.

Use a commandline utility called CACLS.

Open up a command window and run the following command :
CACLS %WINDIR%\assembly /e /t /p [DOMAIN|MACHINENAME]\useraccount:R

...substituting either your domain name (for a domain account) or machine name (for a local
account).

For example :
CACLS %WINDIR%\assembly /e /t /p MACHINENAME\account:R
or
CACLS %WINDIR%\assembly /e /t /p DOMAINNAME\useraccount:R

It *must* be the account ASP.NET is running as...






Juan,

Here is the error I get in Event Viewer when trying to run our application. How to a grant
ASP.NET
user 'read' permissions to the GAC?


Event Type: Error
Event Source: ASP.NET 2.0.50727.0
Event Category: None
Event ID: 1089
Date: 6/19/2006
Time: 9:37:32 AM
User: N/A
Computer: CQL-GR-ST01
Description:
Failed to execute the request because the ASP.NET process identity does not have read
permissions
to the global assembly cache. Error: 0x80070005 Access is denied.

Thanks,

re:
How do we run this new application pool under Network Service

The Network Service account is specific to IIS 6.0.
I don't think you can create a Network Service account under IIS 5.x.

re:
is there a different way to grant the correct permissions to make our application run

The best way to grant the correct permissions for 2.0 is :

aspnet_regiis -GA machinename\accountname
or
aspnet_regiis -GA domainname\accountname

Alternately, you can manually grant whichever account you're
running ASP.NET as, the permisions which this article enumerates :

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx





We have a win2k with SP4 running IIS5. We have Framework v2.0.507277 installed and looking
run
an application in ASP 2.0. We are having troubles because the default user is IWAN which
doesn't have the correct permissions to run an ASP 2.0 application. How do we run this new
application pool under Network Service or is there a different way to grant the correct
permissions to make our application run.