03-31-05 01:12 PM
Hi Yogita,
After upgraded my web server machine to windows 2003, I tried the option #1
and #2 but my application didn't work. In my web server machine, the
application works but if I try to access it by other machine the error: ASP
Error 0178 (80007005) occurs. My application was created as virtual director
y
and uses a dcom component that was installed on the same machine of the web
server. On DCOM config, I tried all options in identity tab and security tab
but the error remains. In IIS, I configured the application to use a domain
user in authentication and access control section but the error also remains
.
I run the command cscript.exe adsutil.vbs set w3svc/logonmethod 2 and
configured an iusr_machinename in authentication and access control section
but the problem was not resolved. Can you help me?
Regards,
CĂ_cero Galdino.
"Yogita Manghnani [MSFT]" wrote:
> Hello All,
> It looks like you are running into this issue because of a change in
> Windows 2003 to enhance security. Here are the details on the issue (this
> info will be published in a KB article pretty soon- Q885656)
>
> **Symptoms**
> You have a web application running on Windows 2003. This web application
> calls a COM+ Application proxy to activate an object on a remote server. I
f
> you have anonymous access enabled within IIS and the anonymous account is
> set to run under the IUSR_SERVERNAME then you will may get one of the
> following two errors when trying to access the page.
>
> Microsoft VBScript runtime error 800a0046
> Permission denied: 'CreateObject'
> /virtualdirectory/asppage.asp, line 2
>
> ------ OR -----------
>
> ASP Error 0178 (80007005)
> Server.CreateObject failed while checking permissions
>
> This exact same design works on a Windows 2000 server environment.
>
> **Analysis**
>
> This problem occurs because of the new default value for LogonMethod
> (MD_LOGON_METHOD) metabase propety in Windows 2003. For IIS5 and Windows
> 2000, the default value for LogonMethod was MD_LOGON_INTERACTIVE (see
> references below). For IIS6 and Windows 2003, the default value for
> LogonMethod is MD_LOGON_NETWORK_CLEARTEXT (see references below). The
> LogonMethod metabase property tells IIS how the anonymous user account
> (IUSR_MachineName) will be passed off of the web server to another remote
> server.
>
> For IIS5/Win2000 when you have a web site that allows Anonymous Access and
> the Anonymous account is configured to run under the IUSR_SERVERNAME
> account, when an asp page makes a request to a COM+ application proxy, and
> this proxy goes off to a remote server, the identity used is NT
> AUTHORITY\ANONYMOUS. The remote server accepts this NT AUTHORITY\ANONYMOUS
> account and maps the request to a local guest account giving that account
> access to activate the COM+ Server object.
>
> For IIS6/Win2003 when you have a web site that allows Anonymous Access and
> the Anonymous account is configured to run under the IUSR_SERVERNAME
> account, when an asp page makes a request to a COM+ application proxy, and
> this proxy goes off to a remote server, the outbound credentials are left
> as the configured anonymous account, meaning
> WEBSERVERNAME\IUSR_WEBSERVERNAME. This account of course will not be
> authenticated by the remote server and thus throws the permission denied
> (800a0046) error.
>
> **Solution**
> You have three options to resolve this problem. The first one is the most
> secure and is recommended over the other 2.
>
> Option #1:
> --------------------
> Configure the IIS Anonymous account to be a domain account (or a local
> admin account that have the same name and password on both machines)
> instead of IUSR_SERVERNAME
>
> - Open up IIS
> - Right-click on your web site and come down to properties
> - Click on the "Directory Security" tab and then click the "Edit…
"
> button in the
> "Authentication and access control" section
> - Put a check in the "Enable anonymous access" checkbox
> - Click the "Browse.." button and then enter in a domain user
> account and their password.
> Note: this domain user account will need to have access to the
> Application Server in order
> for it to not run into any further Permissions problems.
>
> Option #2:
> ------------------
> Use the LogonMethod = MD_LOGON_NETWORK IIS metabase setting. You would
> change this setting to be a value of 2 (MD_LOGON_NETWORK) at the
> application level so that IIS6 will emulate the LogonMethod behavior of
> Windows 2000. This will change the outbound credentials of the request to
> be NT AUTHORITY\ANONYMOUS instead of SERVERNAME\IUSR_SERVERNAME
>
> To set the LogonMethod for the entire web server run this command fro
m
> the C:\Inetpub\AdminScripts directory
>
> cscript.exe adsutil.vbs set w3svc/logonmethod 2
>
> To set the LogongMethod for a specific web site running on the server then
> you will need to identify the ID of that web site through the metabase. Yo
u
> can easily find this on the Windows 2003 server by opening up the
> C:\Windows\system32\Inetsrv\metabase.xml file. Then run the following
> command replacing 709041108 with the id number for your web application:
>
> cscript.exe adsutil.vbs set w3svc/709041108/logonmethod 2
>
>
> Option #3:
> -----------------
> Enable Sub-Authentication, so that you emulate the functionality of Window
s
> 2000. This is the least secure option and not recommended. You can do this
> by referencing the following link:
>
> Anonymous Authentication :
> http://www.microsoft.com/resources/....com/?id=207671
>
>
> Good luck,
> Yogita Manghnani
> Microsoft Developer Support
> Internet Information Server
>
> ****************************************
*****************************
> account name for newsgroup participation only.<<
>
> This posting is provided "AS IS" with no warranties, and confers no rights
.
> You assume all risk for your use.
>
> © 2003 Microsoft Corporation. All rights reserved.
> ****************************************
*****************************
>
>
[ Post a follow-up to this message ]
| 
