Access denied error using GetObject("WinNT://"

[Hakan]

I use the following code to check if a user is an admin in the login page of our intranet.

Set User = GetObject("WinNT://" & UserDomain & "/" & UserName & ",user"
For Each Group in User.Group
Select Case Group.Nam
Case "Domain Admins
Session("Admin")=Tru
Case "Domain Users
Session("User")=Tru
End Selec
Nex

The code works fine on IIS5 and Windows 2000. I have set up a test server with Windows 2003 and IIS6 and created the same application, however the second line of this code returns an error message

Active Directory Error '80070005
General access denied erro

It's obvioulsy a permission issue but I cannot figure out how to get around it. Any help would be greatly appreciated

Thank
Haka

 

[Hakan]

It runs under the Local System account, which is the same as the IIS5 on the live Windows 2000 server.

 

[Egbert Nierop \(MVP for IIS\)]

It runs under the Local System account, which is the same as the IIS5 on

the live Windows 2000 server.

Hi Hakan,

That is impossible. INETINFO.exe might run under localsystem, but it does
not use localsystem to run anonymous users. Most likely IUSR_computer user
will be used for anonymous pages.

Regards,

Egbert Nierop

 

[Hakan]

Sorry Curt, I misunderstood you. The account is IUSR_computer and I tried the domain administrator account with no success. However, if I add the site to the Local Intranet Zone under security option of IE, the code works on the server (Domain\Administrator account). If I do the same thing on my own PC it still doesn't work, though I am a member of the Domain Admins group. Does this shed any light on the issue

----- Curt_C [MVP] wrote: ----

that's the user specified in the IIS manager as the anonymous account
Just for a test, try specifying an admin user once, just to test

--
Curt Christianso
Owner/Lead Developer, DF-Softwar
www.Darkfalz.co

It runs under the Local System account, which is the same as the IIS5 o

the live Windows 2000 server

 

[Hakan]

Sorry, I misunderstood Curt. The account is IUSR_computer and I tried the domain administrator account with no success. However, if I add the site to the Local Intranet Zone under security option of IE, the code works on the server (Domain\Administrator account). If I do the same thing on my own PC it still doesn't work, though I am a member of the Domain Admins group. Does this shed any light on the issue


----- Egbert Nierop (MVP for IIS) wrote: ----

It runs under the Local System account, which is the same as the IIS5 o

the live Windows 2000 server

Hi Hakan

That is impossible. INETINFO.exe might run under localsystem, but it doe
not use localsystem to run anonymous users. Most likely IUSR_computer use
will be used for anonymous pages

Regards

Egbert Niero

 

[Hakan]

Also, if I try to logon from a pc that's not on the domain network (XP Home) and provide DOMAIN\Administrator user name and password through logon dialogue box, it doesn't work.

 

[Hakan]

Also, if I try to logon from a pc that's not on the domain network (XP Home) and provide DOMAIN\Administrator user name and password through logon dialogue box, it doesn't work.