|
Home > Archive > IIS Server Security > June 2007 > Virtual Directory Access Denied
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Virtual Directory Access Denied
|
|
| mikevanhoff 2007-05-02, 7:19 pm |
| I have IIS 6 running on a Win2k3 server. A virtual directory has been
created under the default Web Site at "C:\Reports" As an Administrator I
have no problem running the reports. A non Administrator either gets
prompted for a domain user id and password or simply "access denied" The
virtual directory is set for anonymous access as is the virtual directory.
Both have the integrated options checked since this virtual directory is
outside of the default website directory structure. NTFS Persmissions have
been set to allow the domain users group and the IUSR_<machine> Any clues to
what is going on here will be GREATLY appreciated.
Thanks
| |
| David Wang 2007-05-03, 7:19 am |
| On May 2, 1:43 pm, mikevanhoff <mikevanh...@discussions.microsoft.com>
wrote:
> I have IIS 6 running on a Win2k3 server. A virtual directory has been
> created under the default Web Site at "C:\Reports" As an Administrator I
> have no problem running the reports. A non Administrator either gets
> prompted for a domain user id and password or simply "access denied" The
> virtual directory is set for anonymous access as is the virtual directory.
> Both have the integrated options checked since this virtual directory is
> outside of the default website directory structure. NTFS Persmissions have
> been set to allow the domain users group and the IUSR_<machine> Any clues to
> what is going on here will be GREATLY appreciated.
> Thanks
Please help me understand what you are trying to do and the
constraints of any non-IIS software involved.
Can you clarify what you mean by:
1. What action is getting "access denied". What do you mean by
"running the reports" and how do you do that
2. Are you trying to run a program or read a file from the Virtual
Directory
3. What user identity actually has permissions to run the program or
read a file on the server
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
| |
| mikevanhoff 2007-05-03, 1:22 pm |
| Hi David,
This is actually trying to open a Crystal Report. I have set up Crystal
Reports on other Win2k3 server, and do not have this issue. I have triple
checked both the IIS settings and the NTFS settings from one of my other
working installations, I have had no luck see any misconfiguration in these.
"David Wang" wrote:
> On May 2, 1:43 pm, mikevanhoff <mikevanh...@discussions.microsoft.com>
> wrote:
>
>
> Please help me understand what you are trying to do and the
> constraints of any non-IIS software involved.
>
> Can you clarify what you mean by:
> 1. What action is getting "access denied". What do you mean by
> "running the reports" and how do you do that
> 2. Are you trying to run a program or read a file from the Virtual
> Directory
> 3. What user identity actually has permissions to run the program or
> read a file on the server
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //
>
>
| |
| David Wang 2007-05-04, 7:18 am |
| Then maybe the issue has nothing to do with IIS and is caused by some
other difference between the systems -- perhaps one got "locked down"
and the other did not. There's really no good way to troubleshoot this
situation other than rebuilding or painstaking system comparison. It
is analogous to someone making thousands of random changes on the
system and then asking you to figure them all out - no system makes
this easy.
Try running FileMon and RegMon from www.sysinternals.com to see if
there is unexpected AccessDenied on the server for the non-Admins. It
may shed a clue about the nature of the 401 and where to look next.
Also, check the IIS web log for the exact Win32 error code for the non-
Admin users getting Access Denied. It may shed a clue about the exact
sort of "Access Denied" since as I describe in this blog entry, there
are many types of 401 "Access Denied" which would cause that user
login dialog to pop up.
http://blogs.msdn.com/david.wang/ar...ess_Denied.aspx
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
On May 3, 5:52 am, mikevanhoff <mikevanh...@discussions.microsoft.com>
wrote:
> Hi David,
>
> This is actually trying to open a Crystal Report. I have set up Crystal
> Reports on other Win2k3 server, and do not have this issue. I have triple
> checked both the IIS settings and the NTFS settings from one of my other
> working installations, I have had no luck see any misconfiguration in these.
>
>
>
> "David Wang" wrote:
>
>
>
>
> - Show quoted text -
| |
| trungtran61@yahoo.com 2007-06-07, 7:23 pm |
| On May 4, 2:24 am, David Wang <w3.4...@gmail.com> wrote:
> Then maybe the issue has nothing to do with IIS and is caused by some
> other difference between the systems -- perhaps one got "locked down"
> and the other did not. There's really no good way to troubleshoot this
> situation other than rebuilding or painstaking system comparison. It
> is analogous to someone making thousands of random changes on the
> system and then asking you to figure them all out - no system makes
> this easy.
>
> Try running FileMon and RegMon fromwww.sysinternals.comto see if
> there is unexpected AccessDenied on the server for the non-Admins. It
> may shed a clue about the nature of the 401 and where to look next.
>
> Also, check the IIS web log for the exact Win32 error code for the non-
> Admin users getting Access Denied. It may shed a clue about the exact
> sort of "Access Denied" since as I describe in this blog entry, there
> are many types of 401 "Access Denied" which would cause that user
> login dialog to pop up.
>
> http://blogs.msdn.com/david.wang/ar..._Diagnose_II...
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang
> //
>
> On May 3, 5:52 am, mikevanhoff <mikevanh...@discussions.microsoft.com>
> wrote:
>
>
>
>
>
>
>
>
>
>
> - Show quoted text -
The problem is the CR progess dialog:
This works:
http://www.codeguru.com/forum/showthread.php?p=1494595
| |
| mikevanhoff 2007-06-08, 1:24 pm |
| Thanks for the direction. The final resolution was NTFS permissions on the
physical directory. Crystal Web Server 8.5 requires that the
IUSR_MachineName have full control on the physical directory. Not very
secure, but that is how it is set.
Thanks
"trungtran61@yahoo.com" wrote:
> On May 4, 2:24 am, David Wang <w3.4...@gmail.com> wrote:
>
> The problem is the CR progess dialog:
> This works:
>
> http://www.codeguru.com/forum/showthread.php?p=1494595
>
>
|
|
|
|
|