Background info: Automatically run data connections in XLSM
I have a batch script which logs a start and end time, and runs a VBS scripts, which in turn opens up a excel file, runs a couple of data connections and closes the file again.
This works just fine when I run the batch script. However when I run it through the task scheduler the data connections are not run on the excel file. It seems like it might be related to some sort of security issue, but I cant figure out what the issue is exactly.
In the eventviewer of the server I was setting this up I found this little message:
The machine-default permission settings do not grant Local Activation
permission for the COM Server application with CLSID
{00024500-0000-0000-C000-000000000046} and APPID Unavailable to the
user DOMAIN\USER SID
(S-1-5-21-3431573511-3352521975-2604885492-32293) from address
LocalHost (Using LRPC) running in the application container
Unavailable SID (Unavailable). This security permission can be
modified using the Component Services administrative tool.
But I have no idea what this means.
I ran into the same issue when trying saving an Excel file via a Powershell script. I wasn't able to adjust the security settings for CLSID “000C101C-0000-0000-C000-000000000046”, which should resolve this, so I ran the task under the SYSTEM account, which already had the necessary permissions. This resolved the issue.
This error is being logged into the System event logs in Event Viewer due to inadequate permission for the farm admin account on the DCOM component 000C101C-0000-0000-C000-000000000046. In order to change the permission settings, perform the following steps:
Open Component Service by clicking Start → Administrative Tools → Component Services.
Navigate and expand the node Component Services → Computers → My Computer → DCOM Config.
Right-click the sub node “000C101C-0000-0000-C000-000000000046” and select “Properties”.
On the Properties dialog box, select Security tab. In most cases you will notice that the settings are grayed out. This is because the logged in user doesn't have enough permissions on this component to change the settings. In order to provide this permissions, perform the steps described in next section “Change Component Service Owner and Permission”. You may need to restart the server after doing this.
Once you set up the permission mentioned in previous step, in the Launch and Activation Permissions section in Security tab, select Customize option and click Edit.
In the popup window, add the farm admin user account and check Local Launch and Local Activation permissions.
Restart IIS and SP Timer. If possible, restart the server itself.
Reference: http://sajiviswam.wordpress.com/2011/04/15/the-machine-default-permission-settings-do-not-grant-local-activation-permission-for-the-com-server-application-with-clsid-000c101c-0000-0000-c000-000000000046-sharepoint-2010/
Related
I have an Windows agent in my server. When i run it as Administrator manually its connecting successfully. But when i added it into Task scheduler to start automatically(restart server) its getting this error
TF30063: You are not authorized to access https://dev.azure.com/my-projects
My windows scheduled task added it to Run with highest privileges. But its getting same issue.
To resolve this issue I have two methods/steps.
Step 1 is to clear the credential from credential manager:
Go to Control Panel (with small icon view)-->User Accounts-->Manage your credentials (on the left column)-->Select Windows Credentials-->Scroll down to the Generic Credentials section and look for your TFS server connection.
Step 2 is to click on the operation that Connects to the Team Projects which is the button/plug icon in the Team Explorer tab. Then to also right click the project you are getting this issue on and select Connect:
If possible, you can check if it is useful to you:
How To Fix TF30063 Error
Error TF30063: You are not authorized to access
For more information you can refer this thread
I created IIS website with following setting (ApplicationPool account is named Fitko)
When I run website and submit form with image, application throw an error
UnauthorizedAccessException: Access to the path
'C:\IISWorkspace\Fitko\upload\instructors' is denied.
System.IO.FileStream.ValidateFileHandle(SafeFileHandle fileHandle)
I gave full permissions to Fitko folder to these accounts
IUSR
Users
Administrators
network service
IIS AppPool\Fitko
yet still the UnauthorizedAccessException exception still throwing.
How can I give access permissions to IIS to write to the folder ?
I solve the issue by enabling windows authentication (I had Anonymous Authentication before, but probably it can be enabled together)
the setting is in
Web Project > Properties > Debug > Web Server Settings
and the flag seems to takes control even when the publish configuration is set to release.
In my opinion, the issue typically indicates a permission error of the specific folder.
What is your Application pool identity? try to right-click the folder and grant Everyone Account full access to the folder.
Besides, under certain cases, this might relate to our website framework technology.
https://github.com/stryker-mutator/stryker-net/issues/272
Feel free to let me know if the problem still exists.
In internet service manager right click on the default website, click on edit permission, click on the security tab the click on edit
Add built-in ISUR account to the website and give the appropriate access
and or add built in IIS_IUSERS account and do the same if the above does not work.
I've just moved away from IIS6 on Win2003 to IIS8 on Win2012 for hosting ASP.NET applications.
Within one particular folder in my application I need to Create & Delete files. After copying the files to the new server, I kept seeing the following errors when I tried to delete files:
Access to the path 'D:\WebSites\myapp.co.uk\companydata\filename.pdf' is denied.
When I check IIS I see that the application is running under the DefaultAppPool account, however, I never set up Windows permissions on this folder to include IIS AppPool\DefaultAppPool
Instead, to stop screaming customers I granted the following permissions on the folder:
IUSR
Read & Execute
List Folder Contents
Read
Write
IIS_IUSRS
Modify
Read & Execute
List Folder Contents
Read
Write
This seems to have worked, but I am concerned that too many privileges have been set. I've read conflicting information online about whether IUSR is actually needed at all here. Can anyone clarify which users/permissions would suffice to Create and Delete documents on this folder please? Also, is IUSR part of the IIS_IUSRS group?
Update & Solution
Please see my answer below. I've had to do this sadly as some recent suggestions were not well thought out, or even safe (IMO).
I hate to post my own answer, but some answers recently have ignored the solution I posted in my own question, suggesting approaches that are nothing short of foolhardy.
In short - you do not need to edit any Windows user account privileges at all. Doing so only introduces risk. The process is entirely managed in IIS using inherited privileges.
Applying Modify/Write Permissions to the Correct User Account
Right-click the domain when it appears under the Sites list, and choose Edit Permissions
Under the Security tab, you will see MACHINE_NAME\IIS_IUSRS is listed. This means that IIS automatically has read-only permission on the directory (e.g. to run ASP.Net in the site). You do not need to edit this entry.
Click the Edit button, then Add...
In the text box, type IIS AppPool\MyApplicationPoolName, substituting MyApplicationPoolName with your domain name or whatever application pool is accessing your site, e.g. IIS AppPool\mydomain.com
Press the Check Names button. The text you typed will transform (notice the underline):
Press OK to add the user
With the new user (your domain) selected, now you can safely provide any Modify or Write permissions
IUSR is part of the IIS_IUSER group, so I guess you can remove the permissions for IUSR without worrying. Further reading
However, a problem arose over time as more and more Windows system services started to run as NETWORKSERVICE. This is because services running as NETWORKSERVICE can tamper with other services that run under the same identity. Because IIS worker processes run third-party code by default (Classic ASP, ASP.NET, PHP code), it was time to isolate IIS worker processes from other Windows system services and run IIS worker processes under unique identities.
The Windows operating system provides a feature called "Virtual Accounts" that allows IIS to create unique identities for each of its Application Pools. DefaultAppPool is the default pool that is assigned to all Application Pools you create.
To make it more secure you can change the IIS DefaultAppPool Identity to ApplicationPoolIdentity.
Regarding permissions, Create and Delete summarize all the rights that can be given. So whatever you have assigned to the IIS_USERS group is all that they will require.
When I added permissions for IIS_IUSRS to the site folder, resources like JavaScript and CSS were still inaccessible (error 401, forbidden). However, when I added IUSR, it started working. So for sure you cannot remove the permissions for IUSR.
#EvilDr
You can create an IUSR_[identifier] account within your AD environment and let the particular application pool run under that IUSR_[identifier] account:
"Application pool" > "Advanced Settings" > "Identity" > "Custom account"
Set your website to "Applicaton user (pass-through authentication)" and not "Specific user", in the Advanced Settings.
Now give that IUSR_[identifier] the appropriate NTFS permissions on files and folders, for example: modify on companydata.
IIS_IUSRS group has prominence only if you are using ApplicationPool Identity. Even though you have this group looks empty at run time IIS adds to this group to run a worker process according to microsoft literature.
I would use specific user (and NOT Application user). Then I will enable impersonation in the application. Once you do that whatever account is set as the specific user, those credentials would used to access local resources on that server (Not for external resources).
Specific User setting is specifically meant for accessing local resources.
I'm trying to connect to default web site on localhost – but IIS asks me for credentials (I know I can use an Administrator account, but I'm trying to log on when IIS is not run as an Administrator). I tried putting in the administrator user name and password for windows, but it doesn't accept them.
I'm using windows 7 home premium.
What should I enter?
ok - so anonymous is enabled. The next thing to check is that the identity the website is running under has access to the website folder. Each site in IIS runs in an application pool, and each pool runs under a user account. So first find out what app pool you're running under. On the right hand side click on Advanced Properties and check the name of you application pool. Then close that window and double click on application pools above your website on the left. Click on the app pool your site is running under, and then click advanced properties on the right. In the dialog box that launches, under process model check the value of Identity. Then go check the permissions on your website folder and make sure that identity has a minimum of read and execute rights on the folder.
Added another answer as the text above exceeds the comment limit
If you're trying to set your identity for a site to run under then you either need to run it as the local system account or you need to create a new user account on the machine and use those credentials.
I'm running Windows 7 SP 1 and have just turned on IIS 7. Just trying to access the default page it creates I get a 503 error, and the application pool stops. I look in the event log and I find the error:
Windows cannot copy file \?\C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\SQM\iesqmdata_setup0.sqm to location \?\C:\Users\TEMP.IIS APPPOOL.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\SQM\iesqmdata_setup0.sqm. This error may be caused by network problems or insufficient security rights.
DETAIL - Access is denied.
I tried making the TEMP.IIS APPPOOOL.000 folder available to everyone. I tried making Users available to everyone. No luck, it still dies with the same error.
What is happening here, and how can it be fixed?
It sounds like you're having the same problem as details in this IIS.NET forums thread. You didn't mention if you have x64 Windows 7 or not. Suspect that your development machine is misconfigured somehow; sounds like the uninstallation and reinstallation of IIS7 would help/fix.
Suggested courses of action:
Open IIS and its Application Pools. Open "DefaultAppPool" and any other Application Pools in use.
Click Advanced Settings for each of these. Ensure the "Load User Profile" is set to 'False'
Also ensure that the "Set Application Pool Defaults" has the Load User Profile set to False."
I encountered the same problem in my development environment (Windows 8.1). Instead of disabling the load user profile as suggested by P.Campbell, I went ahead and changed the permission of the sqm file to allow modify accesses for IUSR, IIS_IUSRS and Network Service. In my case, the sqm file was not able to show me the file owner in which I taken over with my user account.
Basically, my problem was solved by giving the correct permission for both source and destination files/folders.
Found the answer here - http://forums.iis.net/p/1180636/1992024.aspx
Open IIS Manager
Find the App Pool that is causing the problem
Open Advanced Properties
Change 'Load User Profile' to false
Fixed!
After struggling with all these Application Pool issues in IIs, I found the problem and the solution. This may help you.
Each application pool on each website in Microsoft's Internet Information Server creates its own user account and folder under the "c:\Users" directory when the pool is created and first run. Its actually a virtual user account and should be named for the Application Pool assigned to your web application in IIs. In most development environments, its the default website or "DefaultAppPool". It uses this temporary user account to run the pool. Each website should have a named user pool account. This User folder is used by the pool and ASP.NET for caching and writing of file resources and other things used by IIs, ASP.NET, and this virtual account.
In some setups people are not seeing this folder but a "TEMP" folder (like you have) when the IIs web site is accessed and using the pool.
If you instead see a "TEMP" folder in the Users folder you have a broken application pool account in IIs and in the Registry. The pool is creating the TEMP folder as a backup for this virtual account, which might not have the right security setup. I had this exact scenario.
To fix it go to the registry under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
See if you have a SID user account with the ".bak" extension for a DefaultAppPool user account. If so delete it and restart your PC. Test your website again, making sure its actually setup to use DefaulAppPool. It should now recreate the "DefaultAppPool" folder in Users, recreate the registry entry for DefaulAppPool user, and your error should go away.
You can delete the TEMP user folder at that point under the Users folder. (Keep in mind if your web app has been storing cached information critical to users of the website, some of that might have to be inserted into the new DefaultAppPool user folder. But for most of us, just delete it.)
I also found I had to add this kooky virtual application pool account to my local database so the worker process and app pool accnt could have the rights to grab data from SQL Server: Just go into SQL Server and under logins add "IIs AppPool\DefaultAppPool" and then assign it as a user to your databases.
(btw whomever dreamed up this virtual application pool account system is nuts....its way too complicated and convoluted to sort out)
After I did this, all my stack overflow errors went away in Visual Studio for my web application, all data connections fired perfectly, all write permission to the default User profile stored properly, and all the restarting and crashing of the Application Pool in IIs ended completely. :)