IIS failing to start: Error BC2000 - security

When i try to start a ASP.net site on IIS 7.5, i get the following error
BC2000: compiler initialization failed unexpectedly: 0x80070005
Searching around i found a possible solution: Go to security settings of C:\Windows\Temp folder and add Full Control permission to users "NETWORK SERVICE" and IIS_IUSRS.
But i did that and the error goes on.
In my machine %temp% points to C:\Users\sp\AppData\Local\Temp , which have those permissions as well.
I also tried using the utility "aspnet_regiis" to reinstall ASP.
Here's the full event log entry (Application Warning 1310):
Event code: 3007
Event message: A compilation error has occurred.
Event ID: 733bee25fcbe4f0ab74b7fc56ce833d7
Event sequence: 3
Event occurrence: 1
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/5/ROOT-1-129798160562503533
Trust level: Full
Application Virtual Path: /
Process information:
Process ID: 8040
Process name: w3wp.exe
Account name: IIS APPPOOL\myapp
Exception information:
Exception type: HttpCompileException
Exception message: vbc : Fatal (0): error BC2000: compiler initialization failed unexpectedly: 0x80070005
Request information:
User host address: ::1
User:
Is authenticated: False
Authentication Type:
Thread account name: sp-PC\sp
Thread information:
Thread ID: 8
Thread account name: sp-PC\sp
Is impersonating: False
Stack trace: at System.Web.Compilation.AssemblyBuilder.Compile()
at System.Web.Compilation.BuildProvidersCompiler.PerformBuild()
at System.Web.Compilation.CodeDirectoryCompiler.GetCodeDirectoryAssembly(VirtualPath virtualDir, CodeDirectoryType dirType, String assemblyName, StringSet excludedSubdirectories, Boolean isDirectoryAllowed)
at System.Web.Compilation.BuildManager.CompileCodeDirectory(VirtualPath virtualDir, CodeDirectoryType dirType, String assemblyName, StringSet excludedSubdirectories)
at System.Web.Compilation.BuildManager.CompileCodeDirectories()
at System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled()
at System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters)
So what i did to work was changing the user of the application pool to the machine administrator (IIS Manager > Application Pools > Advanced Settings > Identity). But that don't seem very safe.
So my question is: Why it isnt working with "Built-in Account" (I tried ApplicationPoolIdentity and NetworkService).

Try below steps-
Set True "Enable 32-bit Applications" for your default application pool if you are running on x64 machine.
Grant Full Accesses for NETWORK SERVICE and IIS_IUSRS on
C:\Windows\Temp\
Grant Full Accesses for NETWORK SERVICE and IIS_IUSRS on
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\

Grant Full Access to the user "Network Service" to the folder C:\Windows\Temp

Related

An unknown server-side error occurred while processing the command. Original error: Failed to locate opened application window with appId

Class Initialization method xxxxx.Features.PublicAppFeature.FeatureSetup threw exception. OpenQA.Selenium.WebDriverException: OpenQA.Selenium.WebDriverException: An unknown server-side error occurred while processing the command. Original error: Failed to locate opened application window with appId: xxxxxxxxxxxxxxxxx, and processId: xxxx.
An Application opened on the Remote machine. But they failed with the above error.
Run on Azure Pipeline on a Self-hosted machine(Window Server 2019 Datacenter)
Application is opened on the machine.
AppiumOptions options = new AppiumOptions();
options.AddAdditionalCapability("app", AppPath);
options.AddAdditionalCapability("ms:waitForAppLaunch", $"{SecondsToWaitOnOpen}");
options.AddAdditionalCapability("ms:experimental-webdriver", false);
session = new WindowsDriver(WindowsApplicationDriverUrl, options);

Azure VM Scaleset custom script extension not working - possibly failing to get VM identity?

I'm attempting to deploy to my Virtual machine scale set using the custom script extension as below.
az vmss extension set --debug --name 'CustomScriptExtension' `
--resource-group 'my-rg' `
--publisher 'Microsoft.Compute' `
--version '1.9.5' `
--vmss-name 'myvmss' `
--settings '{\"commandToExecute\": \"powershell.exe ./download-package.ps1\", \"fileUris\": [\"https://[REDACTED].blob.core.windows.net/upload/download-package.ps1\"]}' `
--protected-settings '{\"managedIdentity\": {\"objectId\": \"[REDACTED]\"}}'
When running I get the following error:
cli.azure.cli.core.azclierror : Deployment failed. Correlation ID: 73f4d16b-afe0-4373-8773-1d7dd7d26940. VM has reported a failure when processing extension 'CustomScriptExtension'. Error message: "Failed to download all specified files. Exiting. Error Message: Exception of type 'Microsoft.WindowsAzure.GuestAgent.Plugins.CustomScriptHandler.Downloader.MsiNotFoundException' was thrown."
More information on troubleshooting is available at https://aka.ms/VMExtensionCSEWindowsTroubleshoot
Deployment failed. Correlation ID: 73f4d16b-afe0-4373-8773-1d7dd7d26940. VM has reported a failure when processing extension 'CustomScriptExtension'. Error message: "Failed to download all specified files. Exiting. Error Message: Exception of type 'Microsoft.WindowsAzure.GuestAgent.Plugins.CustomScriptHandler.Downloader.MsiNotFoundException' was thrown."
The file to be downloaded requires authentication so I have given the scale set a system assigned identity and granted it the Storage Blob Data Reader role on the storage account hosting the powershell file.
The custom extension logs on the VM suggest that it was unable to get the identity of the vm:
[7108+00000001] [11/20/2020 09:12:28.79] [INFO] Handler successfully enabled
[7108+00000001] [11/20/2020 09:12:28.80] [INFO] Loading configuration for sequence number 1
[7108+00000001] [11/20/2020 09:12:28.84] [INFO] HandlerSettings = ProtectedSettingsCertThumbprint: [REDACTED], ProtectedSettings: {[REDACTED]}, PublicSettings: {FileUris: [https://[REDACTED].blob.core.windows.net/upload/download-package.ps1], CommandToExecute: powershell.exe ./download-package.ps1}
[7108+00000001] [11/20/2020 09:12:29.26] [INFO] Downloading files specified in configuration...
[7108+00000001] [11/20/2020 09:12:30.90] [INFO] Attempting to get MSI from IMDS
[7108+00000001] [11/20/2020 09:12:31.04] [WARN] WebClient: non retryable error occurred System.Net.WebException: The remote server returned an error: (400) Bad Request.
at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)
at System.Net.WebClient.DownloadString(Uri address)
at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClient.<>c__DisplayClass3_0.<DownloadStringWithRetries>b__0()
at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClientWithRetryAbstract.ActionWithRetries(Action action)
[7108+00000001] [11/20/2020 09:12:31.14] [ERROR] Unknown exception occurred while attempting to get MSI token System.Net.WebException: The remote server returned an error: (400) Bad Request.
at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)
at System.Net.WebClient.DownloadString(Uri address)
at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClient.<>c__DisplayClass3_0.<DownloadStringWithRetries>b__0()
at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClientWithRetryAbstract.ActionWithRetries(Action action)
at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.WebClient.DownloadStringWithRetries(Uri address)
at Microsoft.WindowsAzure.GuestAgent.Plugins.MsiUtils.MsiProvider.GetMsiHelper(NameValueCollection queries)
[7108+00000001] [11/20/2020 09:12:31.14] [INFO] Msi was not obtained
I can retrieve the identity token from the metadata endpoint via Invoke-WebRequest -Method Get -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' so that appears to be set up correctly.
Any advice on what the problem could be or how to further diagnose this issue would be greatly appreciated.
Here are the few fixes you can try
The object ID of the managed identity might be incorrect.
Please also move commandToExecute and FileUris into protected settings with managed identities.
If want to use system assigned managed identity, you don't need to pass a clientId or objectID, more info here https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows#property-managedidentity
edit: please explicitly pass an empty json object as settings when you add commandToExecute and fileUris to protected settings. Extensions would fail otherwise due to duplicated settings.

Running Derby as a server on Linux using JDK11

I am at my wits end!
I have a minimal install of Ubuntu Server 18.04 and OpenJDK 11 (headless).
Downloaded, to a local folder are the java 9+ binaries for Derby (db-derby-10.15.2.0-bin)
Path and Environment settings are all correct!
When I start the server startNetworkServer -h 0.0.0.0, I get an error when doing a simple connect using the ij command line tool
ij> connect 'jdbc:derby://localhost:1527/dbname;create=true';
ERROR XJ041: DERBY SQL error: ERRORCODE: 40000, SQLSTATE: XJ041, SQLERRMC: Failed to create database 'dbname', see the next exception for details.::SQLSTATE: XBM01::SQLSTATE: XJ001
The derby.log file makes reference to:
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getenv.SOURCE_DATE_EPOCH")
Looking further into this error, I learned that I somehow need a security.profile. I found this website that seemed to be the answers to my problems. https://www.javacodegeeks.com/2020/04/apache-derby-database-jvm-security-policy.html
Following these pretty straight-forward instructions, I get:
java.security.AccessControlException: access denied
org.apache.derby.shared.common.security.SystemPermission( "engine", "usederbyinternals" )
For the next person who has this strange problem (it seems to happen with some regularity, here's a simple workaround, copied from this FAQ page at Chalmers Institute of Technology:
Q: When we try to create a database in Derby and the database explorer in NetBeans, we get one or more of the following error(s):
An error occurred while creating the database:
java.sql.NonTransientConnectionException: DERBY SQL error: ERRORCODE:
40000, SQLSTATE: XJ041, SQLERRMC: ...
Caused by: java.security.AccessControlException: access denied
("java.lang.RuntimePermission" "getenv.SOURCE_DATE_EPOCH")
A: This is some kind of missconfiguration in the JVM with a very aggressive security policy that doesn't allow applications to fetch the time on the system (since epoch). The solution is to edit ~/.java.policy or [java.home]/lib/security/java.policy and add the following:
grant {
permission java.lang.RuntimePermission "getenv.SOURCE_DATE_EPOCH", "read";
};
If you are on Windows you can read about where this policy file is supposed to be located here;
https://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html
Apache-Derby is a database management system prepared for a multi-user environment, therefore, when you execute the startNetworkServer -h 0.0.0.0 instruction, you are telling it by default to take certain security into account, and that is why it does not let you do an insecure connection such as ij> connect 'jdbc:derby://172.16.17.31:1527/BBDD_server;create=true';
because you are connecting without specifying username and password, so you should either connect by specifying username + password, or start the server without any security:
startNetworkServer -h 0.0.0.0 -noSecurityManager
More help:
https://db.apache.org/derby/docs/10.4/adminguide/tadminnetservopen.html
https://db.apache.org/derby/docs/10.4/adminguide/tadminnetservbasic.html

The "InvokePowerShell" task failed unexpectedly when publishing from Visual Studio to Azure

Recently I copied my project (ASP.NET Core on Visual Studio 2015) to a new computer. Everything is set up except that I can't seem to publish to the existing App Service without getting an "InvokePowerShell" error.
I have tried creating a new publish profile, resetting the publish profile for the App Service on Azure, running Visual Studio as administrator but no good. Anyone kindly have an idea how to solve this?
Published 1/1 projects successfully
C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\DotNet\Microsoft.DotNet.Publishing.targets(408,5): Error MSB4018: The "InvokePowerShell" task failed unexpectedly.
System.Management.Automation.PSSecurityException: AuthorizationManager check failed. ---> System.Management.Automation.Host.HostException: A command that prompts the user failed because the host program or the command type does not support user interaction. The host was attempting to request confirmation with the following message: Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning message. Do you want to run C:\Users\rober\OneDrive\Documents\Visual Studio 2015\Projects\willfon\src\willfon\Properties\PublishProfiles\willfon20180423121452 - Web Deploy-publish.ps1?
at System.Management.Automation.Internal.Host.InternalHostUserInterface.ThrowPromptNotInteractive(String promptMessage)
at System.Management.Automation.Internal.Host.InternalHostUserInterface.PromptForChoice(String caption, String message, Collection`1 choices, Int32 defaultChoice)
at Microsoft.PowerShell.PSAuthorizationManager.RemoteFilePrompt(String path, PSHost host)
at Microsoft.PowerShell.PSAuthorizationManager.CheckPolicy(ExternalScriptInfo script, PSHost host, Exception& reason)
at Microsoft.PowerShell.PSAuthorizationManager.ShouldRun(CommandInfo commandInfo, CommandOrigin origin, PSHost host, Exception& reason)
at System.Management.Automation.AuthorizationManager.ShouldRunInternal(CommandInfo commandInfo, CommandOrigin origin, PSHost host)
--- End of inner exception stack trace ---
at System.Management.Automation.Runspaces.AsyncResult.EndInvoke()
at System.Management.Automation.PowerShell.EndInvoke(IAsyncResult asyncResult)
at Microsoft.Web.Publishing.Tasks.InvokePowerShell.Execute()
at Microsoft.Build.BackEnd.TaskExecutionHost.Microsoft.Build.BackEnd.ITaskExecutionHost.Execute()
at Microsoft.Build.BackEnd.TaskBuilder.<ExecuteInstantiatedTask>d__26.MoveNext()
1>Publish failed due to build errors. Check the error list for more details.
========== Build: 0 succeeded, 0 failed, 1 up-to-date, 0 skipped ==========
========== Publish: 0 succeeded, 1 failed, 0 skipped ==========
2-27-2020 And now today it's working. Who knows why.

ASP.Net Core 2.0 IIS error on Windows 2012 R2

I installed :
dotnet-runtime-2.0.0-win-x64.exe
dotnet-sdk-2.0.0-win-x64.exe
DotNetCore.2.0.0-WindowsHosting.exe
On command prompt if I type dotnet, this appears:
api-ms-win-crt-runtime-l1-1-0.dll missing
On IIS on Windows Server 2012 R2 ASP.Net core 2.0 is returning this:
HTTP Error 502.5 - Process Failure
Common causes of this issue:
The application process failed to start The application process
started but then stopped The application process started but failed to
listen on the configured port
Troubleshooting steps:
Check the system event log for error messages Enable logging the
application process' stdout messages Attach a debugger to the
application process and inspect
For more information visit:
https://go.microsoft.com/fwlink/?LinkID=808681
On Windows Logs, this appears:
Application 'MACHINE/WEBROOT/APPHOST/CRUD' with physical root
'C:\inetpub\wwwroot\WebAPI\CRUD\' failed to start process with
commandline 'dotnet .\CRUD.dll', ErrorCode = '0x80004005 : c0000135.
How to solve this problem?

Resources