IIS lockdown tool woes

[Alvin Bruney]

I've run iis lockdown and debugging stopped working. I've added the debug
verb to urlscan. The error message is asp.net and atl server cannot be
debugged. I haven't seen this one before. If I reverse the tool, debugging
works fine. I'm choosing asp dynamic server and accepting all the defaults
in the tool. I'm sure I'm missing something minor.

 

[Ken Cox [Microsoft MVP]]

Hi Alvin,

Aren't there some other things you need to do once the lockdown has messed
up your system?

HOW TO: Configure URLScan to Protect ASP.NET Web Applications

http://support.microsoft.com/default.aspx?scid=kb;en-us;815155

Is there anything in the \inetsrv\urlscan\*.log that might tell what is
being blocked?

 

[Ken Cox [Microsoft MVP]]

Oh... just checking... DEBUG may be case-sensitive.

 

[Alvin Bruney]

Ya i got the case sensitivity, i've added the aspx extensions to the urlscan
file but that didn't help. Anything else I could have missed?

 

[Ken Cox [Microsoft MVP]]

Hey Alvin,

Did you get it running yet? If so, what was the fix?

Ken

 

[Alvin Bruney]

No I haven't. Still looking...

 

[Alvin Bruney]

Ok I found this insidious piece of nastiness. After applying the DEBUG verb
change to the urlscan.ini, IIS must be restarted in order to pick up the
changes.

You can tell i pulled my teeth on this one eh.

 

[Ken Cox [Microsoft MVP]]

Arrggh. I was going to suggest the reboot but figured you'd do that anyway.

Glad to hear you *finally* got going again.

Ken

 

[Guest]

I have this exact problem too, only it's been a few months
since I ran the lockdown tool, so I can't undo it without
losing a bunch of changes I've made since then. Someone
help, the person teaching this class is getting impatient!

 

[Alvin Bruney]

you've added the debug verb to the url scan?

 

[L Wick]

I just did - I found the original post in a search window
and didn't see the rest of the thread until I hunted it
down in the main window, AFTER I'd already posted my
question. At this point it will have to wait until
tomorrow, I've got 25 people busily working on their
assignments right now.

Does anyone know if non-admins are able to remote debug
asp.net projects? Some things say you have to be a member
of admins AND debugger users, some say OR. I've followed
all the other steps to allow remote debugging, but I can't
make students admins on the server...