Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Access Denied e IIS, un articolo

Lorenzo Barbieri @ UGIblogs! — Fri, 27 May 2005 22:35:13 GMT

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Tony Warren — Mon, 13 Jun 2005 00:39:50 GMT

I've added the account used for anonymous authentication to the administrators group and I still get the error.

THAT should have fixed it.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Tue, 14 Jun 2005 20:33:11 GMT

There are many types of "access denied":
401.1 - incorrect username/password
401.2 - incorrect authentication protocol
401.3 - lack ACL on resource
401.4 - denied by ISAPI Filter for some reason
401.5 - denied by application for some reason

Until you determine the type of "401 access denied", random changes will not help.

For example, adding anonymous user to the administrators group ASSUMES that the problem is 401.3 - that you are anonymous authenticated and that the anonymous user lacks ACL on the resource. However, if this is not the 401 error, or if administrators group is denied or lacks ACLs on the resource (as mentioned above), then you will STILL have access denied.

In other words, adding anonymous user to the administrators group makes very little sense. There is no sure-fire way to never see access-denied. You need to use the IIS log file to determine WHY you are getting access denied and then address that.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Rex — Tue, 26 Jul 2005 15:11:09 GMT

I have got an interesting problem, I have a web site that uses Integrated Windows Authentication to determine the user. If I browse to the site from my desktop, I enter my user name and password, and get access to the site, however, when I browse to the web site from the server that it is hosted on, I get Unauthorized: Access is denied due to invalid credentials (using the same username and password). Enhanced security is not enabled, and I have disabled and enabled the proxy settings, as well as add the site to the trusted sites list. Any other ideas?

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Greg Muir — Mon, 08 Aug 2005 17:34:26 GMT

I'm getting a 401.1 error. The weird thing is that everything was working just ducky last week. This server is intended for intranet use as well as distributing Crystal Reports via the crystal .net interface.

The only thing I can think of that's changed since Friday is the default name of the site. I'm going to check that one out, maybe permissions are still granted for the old name.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Zach Li — Wed, 05 Oct 2005 08:46:34 GMT

I am also getting a access denied. My error is 401.3 Does anyone has any idea of overcoming the problem?

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David Wang — Wed, 05 Oct 2005 23:03:54 GMT

Try diagnosing 401.x errors at:
http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

mark glanville — Thu, 03 Nov 2005 16:38:09 GMT

THANK YOU!!! you just saved me hours of playing with settings... ta!

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Ben — Tue, 15 Nov 2005 03:37:31 GMT

Hello David,

I have played around with permissions but I still can't get our website to work without having to logon with a username / password.

Our test site required a username / password but our Default Website is working perfectly via a browser.

Default Website:
http://localhost/v3/home.asp -> no username / password required

Test Site:
http://test.ourdomain.com -> username / password required

Please help.

benc007@sbcglobal.net

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Ben — Tue, 15 Nov 2005 03:47:03 GMT

Test Site:
http://test.ourdomain.com -> username / password required

It asks for a username / password but I can just click "Enter", it disappears and everything works. Please help.

benc007@sbcglobal.net

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Ben — Tue, 15 Nov 2005 13:37:40 GMT

I have another server set up using anonymous access and both the Default Website http://localhost/v3/home.asp and the Test Site http://test.ourdomain.com work.

I think the problem is that this server has two IUSR_MACHINENAME accounts since I changed the MACHINENAME sometime ago. I removed and re-installed IIS, but the two IUSR_MACHINENAME accounts still exist. How can I fix this?

ie. IUSR_OLDMACHINENAME and IUSR_NEWMACHINE exist.

benc007@sbcglobal.net

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Christopher King — Thu, 09 Feb 2006 18:49:01 GMT

thanks for the reminder and clarification around this; was exactly what I was looking for :-)

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Ganeshs — Tue, 04 Apr 2006 06:22:14 GMT

i am having problem in uploadignn file to a server.....
its shows "405 HTTP verb used to access this page is not allowed".
Please help me to figure this....

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Tue, 04 Apr 2006 11:10:44 GMT

Ganeshs - I suggest searching for the common solution to your issue.

You are most likely either:
1. uploading the file to a URL that is considered "static file" by IIS (i.e. does not run code). Obviously, POSTing to a page that does not execute code won't upload the file, so a 405 is returned.
2. uploading the file to a URL which resolves to a default document (i.e. http://localhost/vdir or http://localhost/vdir/ ). Behavior is by-design.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Wed, 19 Apr 2006 00:06:00 GMT

It's another 10K entry!

//David

Is it ok to Change the IIS6 Service User Account?

David Wang — Sat, 22 Apr 2006 05:22:12 GMT

Sigh... security continues to befuddle users... because why would you change the Service User Account&nbsp;from...

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Zoran — Thu, 27 Apr 2006 19:46:17 GMT

It's good stuff, but no one seems to have had my problem... :-( I can't start my WWW service on this server with exchange to access OWA.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Thu, 27 Apr 2006 22:19:29 GMT

Zoran - I suggest looking at the list of troubleshooting links I have on the sidebar of my blog and helping yourself. Starting with this one:
http://blogs.msdn.com/david.wang/archive/2005/12/31/HOWTO_Basics_of_IIS6_Troubleshooting.aspx

In general, you do not want nor need to look for someone else's solution for their problem which seems SIMILAR to your problem. Pattern-matching is a dangerous way to solve problems. You want to independently diagnose your problem (that's what my troubleshooting links are for), and once you know the cause, resolve it directly.

In other words, there are millions of ways that WWW service won't start on a machine, with or without Exchange/OWA. Looking for other people's solution is like looking for a needle in a haystack, and if their situation is not exactly like yours, you have no idea whether their "solution" applies.

Instead, simply diagnose why WWW service won't start. When you run on the commandline:
NET START W3SVC

What do you get? And if there is an error, what are logged in the Event Logs for System and Application?

//David

HOWTO: Rename the Computer running IIS6

David Wang — Mon, 01 May 2006 12:42:00 GMT

Question:
Hi ,
I have two web servers. One web server(w2k3Ent) and IIS 6.0 in a work group and One...

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Deepankur Kukreja — Wed, 07 Jun 2006 10:43:33 GMT

I am facing an issue with my IIS 6.0, when i click on browse through my IIS Manager console onto my Default Web Site, my IUSR account is also added to the list of my Administrators group and the password has been set for that. Also the option of Enbale Anonymous Access in checked and so is the option of Integreted Windows Authentication.

Please help.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Deepankur Kukreja — Wed, 07 Jun 2006 10:51:58 GMT

Forgot to mention that the error is same ACCESS DENIED :-(

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Wed, 07 Jun 2006 13:17:25 GMT

Deepankur - I suggest diagnosing your issue by reading:
http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx

The way to deal with a 401 Access Denied is to first determine the sub-status of 401 from the log file, then consider the common causes listed in the blog entry. The blog entry is not exhaustive - it is just to get you thinking about possibilities.

As I explained earlier in this blog entry, just because IUSR is in Administrators, or enabling Anonymous Access does NOT mean you will never see Access Denied when browsing, no matter if it is through the IIS Manager console or through a web browser.

For example, in your situation, if the configured anonymous user is locked out or denied logon on this server, you will definitely see "Access Denied" no matter what you change - Anonymous access is enabled so IIS always tries to logon the anonymous user, which if locked out or denied logon, will always fail REGARDLESS if it is in the Administrators group, thus always resulting in 401 Access Denied no matter if using IIS Manager console or web browser.

This is also why I suggest reading this blog entry for following a sound methodology for troubleshooting IIS:
http://blogs.msdn.com/david.wang/archive/2005/12/31/HOWTO_Basics_of_IIS6_Troubleshooting.aspx

Also, see the sidebar on my blog website for additional "Favorites" blog entries that users read.

//David

IIS, Security Templates, and Anonymous Authentication

David Wang — Sun, 02 Jul 2006 01:40:34 GMT

Sigh... security is never black and white, is it? :-)&nbsp;
Question:
Environment: IIS6.0 Windows 2003...

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

omri swissa — Wed, 02 Aug 2006 17:16:53 GMT

i'm working with Office server and Project 2007 (beta 2). i'm trying to access the PSI (Project web services).
when i'm trying to browes the site i get 401.3 but when i use IE i can see the site. why?

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Thu, 03 Aug 2006 03:17:30 GMT

omri - Since you have installed non-IIS software on top of IIS which can alter server behavior, the reason for any behavior is arbitrary and determined by server-modifications made by the Office server product.

My guess is that it is using customized forms authentication which IE will negotiate, but other HTTP clients/browsing will not do correctly after passing anonymous authentication - hence 401.3. But it is just a guess - one needs to know an debug the server configuration to figure out what is going on.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

John — Thu, 03 Aug 2006 15:53:53 GMT

I have an ASP (not ASP.NET) application installed in Vista (Build : 5384). This application is using a C++ COM DLL. The ASP application is unable to access the C++ COM DLL. It is giving an error. When I open the Security Event Log, I can see this

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8F7B0B2D-4DC3-331D6-8847-00B0D06FF25E}
to the user DOMAIN\USER SID (S-1-5-21-1412128295-2049115561-7473742-1796) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

I followed the steps given in the KB article (http://support.microsoft.com/?kbid=899965). Still I am getting the same problem.

Can anyone give me some suggestions regarding the above said problem.

-John

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Phil — Thu, 10 Aug 2006 22:23:04 GMT

I worked yesterday and opend two new projects. I turned off the computer in the night and today i can't open them because of:

HTTP/1.1 403 Access Forbidden

I tried to change all folder permissions.
Even if I try to make a new project in the C:\Inetpub\wwwroot folder it says Access Forbidden

I have IIS 5.1 and 6. It's seems to run with 6 but the LogFiles say 5.1

Don't know what to do anymore... sitting here for hours!
Does anyone have the same problem?
Thx a lot,

Phil

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Thomas — Thu, 31 Aug 2006 08:04:05 GMT

Please remove the anonymous access and try again it works.

:]

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Al C — Tue, 05 Sep 2006 07:00:48 GMT

I have anonymous access enabled for a web site in IIS. If I try to go to the web site, I get challenged for a user name and password. If I enter an administrator username and password for the server, it lets me it to the web site. If I cancel, I get a 401.3 error. When I check the log, the entry says that it rejected user serverName$ (where serverName is the name of my server). I added the IUSR_serverName account to the ACL for the directory, but apparently that is not the user accessing the directory. After reading all of these posts, it seems like I am close. Any ideas?

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Darren — Sat, 07 Apr 2007 19:42:25 GMT

I have a similar problem on SBS Premium and Standard 2003 where all users were configured during the setup using the wizards etc. Inside my LAN I can access the OWA as the different users but from the net only the Administrator can get in. I tried with users set up as administrators but this does not work.

Any help would be appreciated

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

wmelvin@admerexgroup.com — Tue, 17 Jul 2007 21:44:29 GMT

I am having an odd situation that I hope someone can help with. I get a 401.3 error whenever I attempt to click on a link pointing to a .DOC file. If I point to an .HTM file in the same directory the file is displayed. Also the site is running over SSL. Anonymous access is enabled and using IUSR...

On one of my ASP.NET pages I have an ASP:Table that I populate at runtime with several peices of information. One of the things that I add to the table is a Link control to link to a word document in a particular directory under my virtual directories root.

(physical directory structure)

C:\

---->Deployments

--------->Clients

--------------->wwwroot

--------------------->images (directory containing the images for the site)

--------------------->arcletters (directory containing the .DOC files)

--------------------->bin (directory containing dlls, etc)

---------------------default.aspx

---------------------letters.aspx

bla bla bla....

Based on your previous suggestions I downloaded FileMon and saw that it is indeed the IUSR user that is being denied access to the arcletters directory. When I click on the link mentioned above I get a new windows with the 401.3 error. If I run the same code from my local machine I get a prompt asking if I would like to save the document (which is the desired functionallity).

My question is, do you have any suggestions for me and is there a difference between opening a .DOC file and an .HTM file via a link? Also I forgot to mention that I have given IUSR full control of the arcletters directory with no improvment.

Thanks,

William

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Ed — Wed, 18 Jul 2007 18:02:01 GMT

I have been fighting to get things set up for Interdev debugging on Windows XP SP2 with IIS and Front Page Extensions 2002 for DAYS to no avail. I am so frustrated and cannot for the life of me figure this out.

I get prompted for username/password when I try to either launch interdev's debugger or when I try to check server extensions from the IIS control panel.

I have added full control permissions on all the folders to Everyone.

When I try to check server extensions I am prompted for:

enter the username and password for user "" on http://machinename

When I try to run debugger in Interdev I am prompted similiarly for a username and password for a user account with permissions to debug.

My own user account has full permissions on all folders and is a member of Administrators.

My user account does not have a password associated with it and never has.

The http error I get is a 401.1

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Garima — Fri, 20 Jul 2007 13:15:00 GMT

Hi,I am running Project Server 2003 with win server 2003.I am able to access the projectserver bt if i try to connect the client with the server with the same username and password is giving error of http 401.1-unauthorised access.wht to do im stuck with this problem for the last 2 days.Please help me.

garima_chandra@rediffmail.com.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Sat, 21 Jul 2007 14:33:09 GMT

William - there is no difference to IIS between a DOC and HTM file. They are both static files served for download by default. You *may* be running 3rd party ISAPIs on the server that result in different behavior between different file extensions.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Sat, 21 Jul 2007 14:38:01 GMT

Ed - by default, XP simply does not allow network login of user accounts with blank passwords. You may be hitting that in some fashion - no amount of giving ACLs to Everyone will help if Windows is not even allowing the user to login (401.1).

You will have to configure XP to allow such logins of accounts with blank passwords, but I wouldn't do it in your case since you are running as administrator with no password.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Prithwish — Wed, 25 Jul 2007 15:05:24 GMT

I have enabled Anonymous Access in IIS. But for its not eve asking for any id password, rather its directly showing access denied error. http://www.eorangecountyrealestate.com/ http://www.ilongbeachrealestate.com/ for both of this option it says "You are not authorized to view this page". Can any one help regarding this issue? p.biswas@yahoo.com

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Lorie — Thu, 26 Jul 2007 05:40:56 GMT

I apologize for asking a question that may have already been answered. I'm not familiar with changing settings. I just begun learning ASP and knowing what IIS does and everything was working fine until I installed .net framework and it created this administrator password and I have no clue where to change these setttings.

It makes me not want to do mess with the whole deal, but I don't want this situation to keep me from learning.

I've tried reading these links and articles but it all going over my head. Please, if anyone has found a way to change these settings so it allows me to access my IIS again, please point me in the right direction.

Thanks a mil!

Lorie

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Fri, 27 Jul 2007 07:07:33 GMT

Prithwish - Enabling anonymous access in IIS does NOT mean you will not get Access Denied. Please start with the "401 Diagnosis Guide" link on the sidebar of this blog to start troubleshooting your misconfiguration.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Robert Mack — Mon, 17 Sep 2007 16:51:01 GMT

I get "You have been denied access to this machine" when I try to administer IIS in the snap-in console. I am logged in as domain admin. I also get "Cannot find server or DNS Error" when I try to access web pages on the machine. This is a Win XP Professional workstation (SP2) on which everything has been working perfectly for a couple of years, including a couple of web apps I developed in VS. When I do a NET START, the system reports that the service has started. When I open the Windows Firewall config in Control panel and click the Advanced tab I see a message that says the "Network Connection Settings have become corrupted." It suggests clicking the Restore Defaults button, but when I tried that, nothing happened. I tried installing authdiag, but when I run the MSI file, I get a message saying that the Windows Installer Service could not be accessed, although when I try to re-install the Windows Installer, I am told that it is already installed.

The only thing I have done is re-register the machine on my development network (one Win 2000 server and 2 workstations - Win 2K and XP).

Any ideas? I am at a total loss.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Robert Mack — Mon, 17 Sep 2007 19:35:00 GMT

OK. I fixed the problem myself by using Windows XP System Restore. This feature is a bloody godsend and I didn't even know it existed! My whole development server with a number of revenue-generating projects had gone kaput. I was in panic mode.

Looked at the system logs to see when the error messages started coming - I still can't figure out what happened - and restored to the first point previous to that. I guess the machine got corrupted somehow. No viruses or worms present, so must have been some sort of system glitch.

Thank you Microsoft!

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Sanjay Mishra — Sat, 22 Sep 2007 07:41:44 GMT

Dear All

I have win2k3 with IIS 6.0. Every Morning I get 401.1 Error. The Directory security has been set to Anonymous Access, Once I give IISReset everything starts working again for for few hours and again it stops

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Nathan — Fri, 04 Jan 2008 01:26:30 GMT

I have Windows 2000 and everytime I log in as an Administrator and try to install new hardware or anything, it says "You do not have sufficient security privileges to install or uninstall devices on this computer. Please contact your site administrator, or log off and log on again as an administrator and try again." Naturally, I have tried many times to no avail. I even made two other accounts allowing Admin. access and yet both of those also don't allow me to install new hardware. I don't seem to have any administrator access anymore but all the profiles are listed as having administrator access. Am I missing something? What is the problem here?

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

tarriin — Sat, 05 Jan 2008 02:58:16 GMT

Guys,

In case of ISAPI filters for your IIS. Giving IUSER ACL will not help on win2k3.

U need to give execute permission to cmd.exe on the box.

This will do the job.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Sun, 06 Jan 2008 13:28:50 GMT

Nathan - your problem sounds like it is related to Group Security Policy in Windows and not IIS.

There are security policies within Group Policy that prevent users from altering hardware configuration (to lock down against people plugging in USB memory sticks, for example), regardless if you are an "Administrator" or not. See the following:

http://www.microsoft.com/technet/technetmag/issues/2007/06/GroupPolicy/default.aspx

I think you want to investigate in this direction.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Sun, 06 Jan 2008 13:37:08 GMT

tarlin - thanks for the advice, but it is really not correct.

See these blog entris for the explanation:

http://blogs.msdn.com/david.wang/archive/2005/06/29/IIS_User_Identity_to_Run_Code_Part_2.aspx

http://blogs.msdn.com/david.wang/archive/2006/04/28/HOWTO-Run-Console-Applications-from-IIS6-on-Windows-Server-2003-Part-2.aspx

ISAPI Filters run as process identity by default, not IUSR, so changing ACLs do not help.

Furthermore, cmd.exe is locked against access by non-interactive or non-administrators by default, so execution permission does not really matter.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Lorna Mayes — Sun, 20 Jan 2008 21:11:38 GMT

I have just brought a Laptop with Vista Business when I first set it up I could view the sidebar now when I log on I get a message saying the system administrator controls the sidebar and I cannot view or make changes to the sidebar.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

paulwigg@atcollege.eu — Tue, 29 Jan 2008 15:17:07 GMT

THE GROUP POLICY SNAP IN WAS UNABLE TO SAVE YOUR CHANGES DUE TO THE FOLLOWING ERROR :ACCESS DENIED

Can you help with this problem

PAUL WIGG

paulwigg@atcollege.eu

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

JG — Thu, 31 Jan 2008 21:31:48 GMT

Hi..last day when I was loggd in as administrator, i changed the C drive security settings to denied unknowingly :-(. Now I am getting all the time C drive as "Access denied"...I am unable to see any option to change the security settings now..please help me..thanks!

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Fri, 01 Feb 2008 11:19:19 GMT

JG - take that hard drive out and put it in another machine you have successful Administrator access, and reset ACLs there.

Personally, I would not trust your ACLs on that drive to be secure after recovery, but that's another issue.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

JG — Tue, 05 Feb 2008 19:52:33 GMT

Thanks a lot david for reply. But I am having laptop with VISTA as OS. I am less aware of the hardware stuffs. I am planning to format the OS itself. Will that over come this problem?..Please suggest me a proper way. looking forward for ur reply. Thanks!

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Angie — Thu, 13 Mar 2008 23:11:07 GMT

I have been getting things from a E mails from a particular place and every time that I try to look at or read them I get a thing on my computer that says access denied.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Angie — Thu, 13 Mar 2008 23:11:21 GMT

I have been getting things from a E mails from a particular place and every time that I try to look at or read them I get a thing on my computer that says access denied.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Ken Schall — Mon, 17 Mar 2008 21:07:56 GMT

Hi David,

You're probably getting sick of postings on this thread, and I apologize for posting another.

We have a Win2K3 server running IIS 6. One of the virtual directories has anonymous authentication set (all other authentication modes are disabled). The host anonymous account works on other applicable virtual directories on the server. Recently, some users at one site started getting prompts for a user ID and password when accessing the site in question. It is in their trusted/Intranet sites in IE settings and the authentication on the client is set to use the current credentials to authenticate. We have cleared their cache and cookies to see if it was being caught from previous security settings (default settings of anonymous and Windows authentication - the latter has been turned off).

I have double checked the ACL list on the folder for the virtual directory and the anonymous account has read permissions to the folder. This has started since the removal of the Windows authentication on the virtual directory. It also doesn't do it all the time. It will work for a time, then all of a sudden prompts for a user ID and password.

Any ideas? Thanks in advance.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Tue, 18 Mar 2008 10:36:53 GMT

Ken - look at the IIS log entries when users see the user ID/password prompts. If it is 401, use this blog entry to diagnose.

http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx

If it doesn't match the patterns in there, them my suspcion would be Group Policy (if the machine is in a domain) that may be periodically sweeping through the machine and affecting the configured Anonymous user account for the virtual directory in question.

I would wager that it happened after you remove Windows Authentication because earlier, if anonymous authentication failed, IE would auto-login with the user's domain credentials and likely succeed, thus covering up the fragility of Anonymous user credential.

And since IIS caches the anonymous user token by default and filesystem ACLs are unlikely to change over the period of time in question, fluctuating behavior most likely come from external sources.

And the most random external source of fluctuation is Global Policy that change user permissions, privileges, group membership, etc.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Raymond — Sun, 16 Nov 2008 16:34:45 GMT

Thanks for the info. However, if it is not too much trouble, could you also explain ***HOW*** I could change an ACL???

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

macac — Wed, 14 Jan 2009 06:06:46 GMT

I have the solution :) run out and buy yourself a mac, widows is a piece of crap, always has been and always will be.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Sat, 17 Jan 2009 07:08:32 GMT

macac - Sorry, Macs are no better. Apple will never tell the truth about the constant patching and mislabeling of security patches as "performance enhancements".

Mac users delude themselves into thinking it is better (after all, they just paid a bundle for it -- they'd feel like a sucker otherwise)! Apple is more than happy to say anything to keep users thinking that way.

Will you be like Neo and wake up from the dreamy Matrix? Or will you be Cipher and rat out your friends?

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Walter Ferrari Véras — Thu, 19 Feb 2009 22:43:24 GMT

Sorry, but if I'm logged as administrator I can change the owner and the objetcts permissios to get effective access to all objects.

I'm try to change the owner and the permissions to have full control to these objects and the windows return "access us denied" at "Advanced Security Settings for [object]".

What's happen with this system ?

When I was OpenVMS System Manager this situation was impossible! The System Manager was the Machine King.

Walter

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David.Wang — Mon, 02 Mar 2009 16:28:24 GMT

Walter Ferrari Veras - if on Vista/WS08/Win7, then you have UAC active and need to elevate your action, which grants those permissions to your interactive user to use on that action. When non-elevated, the administrator cannot change ownership even if it is a privilege the user holds.

This security system gives good compromise to allow people to have access (under user permission) to all sensitive administrative privileges but NOT have them freely available by default for malware to attack the user.

The outdated approach of OpenVMS where Administrator is machine king is still there if you turn off UAC, but that option is for the knowledgeable.

//David

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Qureshi — Tue, 03 Mar 2009 10:32:59 GMT

Sir, my website is on godaddy with IIS6, i am getting access denied error when i upload the images using back office, what is the problem, in IIS setting only 3 previliegs are there

First i have enter the directory name and there are 3 option Anonomious Access, Directory Browsing, .......

Please tell me what i do, so remove this error.

its too urgent

i m waiting 4 ur reply

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Qureshi — Tue, 03 Mar 2009 10:33:19 GMT

Sir, my website is on godaddy with IIS6, i am getting access denied error when i upload the images using back office, what is the problem, in IIS setting only 3 previliegs are there

First i have enter the directory name and there are 3 option Anonymous Access, Directory Browsing, .......

Please tell me what i do, so remove this error.

its too urgent

i m waiting 4 ur reply

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Anasthase Kajugiro — Fri, 27 Mar 2009 07:07:00 GMT

I do not want to be denied access when I need continue working on my computer. I need to have access to all that I want to see.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Anasthase Kajugiro — Fri, 27 Mar 2009 07:07:59 GMT

open up whatever I need to see and use on my computer.

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

Bob — Wed, 07 Oct 2009 22:25:07 GMT

using XP Pro - New board with SATA HD - copied some folders to cd/rw.

After copy - removed most files & folders; but some would not allow removal (Access Denied).

Subsequent writes include the folders and files I cant remove.

That's a big problem.

Anyone have any suggestions?

Please contact via emal (I am slow reader and blogs take me hours to read) - bob6238@gmail.com

Thanks

re: Why you get Access Denied despite being an Administrator or enabled Anonymous Access in IIS

David K — Mon, 02 Nov 2009 21:32:08 GMT

I have an intranet site that, for some reason, when first loading gets a 401.1 error.

Hit refresh and it comes up just fine. This is more of a nuisance than anything else but I just trying to figure out why it would only happen at first and then work.

Thank you in advance.