Problems after changing Identity Application Pool Settings (sn-yycbk.dll)

[Howard Hoffman]

Applies to: W2K3 Server / IIS6 / Default Isolation Mode / ASP.NET 1.1

We wish to run our ASPNET worker process in a domain account so as to use
RDBMS trusted connections.
We have created a domain account for this purpose.
We have added this domain account to the W2K3 Server
machine IIS_WPG group as per
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/ht
ml/cpconidentityapplicationpoolsettings.asp).

We use this machine to host some WebServices.

Our WebService apps write to 2 directories on the web service machines, so
we've added granted IIS_WPG full-control to those directories.

I changed the Application Pool Identity to Configurable, to use the account,
then ran iisreset at the command line.

However, we execute the web service APIs we get unexpected errors. There
are no errors in the machine's event log, but the WebUI callers of the Web
Service APIs get SoapExceptions with an error message I've never seen
before:

[Server was unable to process request. --> File or assembly name
sn-yycbk.dll, or one of its dependencies, was not found.]

I've also seen the file name 'c6ipnd1t.dll' and 'vlk9wnbd.dll' referenced.

Those file names seem like they could be ASP.NET generated assemblies, but I
cannot find them in %windir%\Microsoft.net\Framework\v1.1.4322\Temporary
ASP.NET Files, or any of its subdirectories. According to TaskManager, the
w3wp.exe process is indeed running under our domain account, as per the
modified configuration.

Can someone provide any clues as to what I can do to clear up this issue?

Thanks in advance,

Howard Hoffman

 

[richlm]

Adding the new account to IIS_WPG is only part of the story. Additional security settings are needed for ASP.NET

Verify that your account (or IIS_WPG) has the following privileges (via local security policy)
- Access this computer from the network
- Deny logon locally
- Log on as a batch job
- Log on as a servic

If this does not help, below are a couple of links with more comprehensive information e.g. on required NTFS permissions

How To: Create a Custom Account to Run ASP.NET (IIS 5.0 specific !!!! - you will need to improvise
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT01.as

INFO: Default Permissions and User Rights for IIS 6.
http://support.microsoft.com/default.aspx?kbid=81261