HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jvierra — Fri, 28 Apr 2006 19:10:53 GMT

That was teh best short explanation of how it all works that I have ever seen. I think, for the first time, I understand all of to pieces.

You should save this and post it somewhere obvious.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Fri, 28 Apr 2006 23:27:43 GMT

jvierra - thanks for the suggestion. I am planning to do that with this post because it lays down the foundation for understanding how request processing works on IIS6 - it is rather straight forward once you see it all - and should help in understanding how to configure and troubleshoot it, too.

I will probably make additions to it as time goes on (there are still tons of interesting details missing), as new posts, etc...

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jvierra — Sat, 29 Apr 2006 00:16:53 GMT

IIS has always been somewhat poorly documented with MS seaming to go for web site and business apps and not providing in-depth technical information about how IIS works under the covers.

I have been using IIS since it first debuted. I have found that, once you get to know it it is really quite simple.

Except when I have to do something extra. esterday I needed to set up a scond SSL site on a WS2003 SP1 server and relaized that there is no way to specify a header value.
Looking at teh IIS manager page I thought that ther must be a way to do this. I though - maybe MetaDat Editor???

I also had just discovered the following webcast. Who knew?

TechNet Webcast: Using Host Headers with SSL-Enabled Web Sites in IIS 6

https://msevents.microsoft.com/cui/EventDetail.aspx?culture=en-US&EventID=1032280959&EventCategory=5.0 (Level 200)

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Maurits — Sat, 29 Apr 2006 00:52:27 GMT

the leading-newline problem could be worked around by using a batch file. Consider:

:: net.bat ::
@echo off

rem issue a blank line to terminate the headers
echo.

rem run "net.exe" with the arguments supplied to net-iis.bat
net.exe %*

rem Don't leave off the ".exe" above or you'll infinitely recurse!

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jvierra — Sat, 29 Apr 2006 01:10:59 GMT

Well, as long as we are going to use scripts how would using this work:

set objShell = Server.CreateObject( "WScript.Shell" )
objShell.Exec( "FSUTIL.EXE" )

while not input = "someline"
input = objShell.Readln()
wend

Do what you need with reformatting the lines and sending them to the browser.

This would avoid some issues but is still not the easiest way to set up.

I would try and build everyting in script embedded in the ASP web page. All of the commands listed can have script couterparts. You would need to run the web application at an elevated privilege or only allow admins to use it. All things like quotas and such are available from either AD or from WMI.

I would also consider using NET 2.0 as it has access to the system management objects and can be made to work in a web application.

The only issue I have found with this is that the web server cannot access other hosts under any circumstances without being allowed to delegate.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Sat, 29 Apr 2006 09:34:10 GMT

jvierra - I agree. IIS has long been a platform that played second-viola to all the other Microsoft Servers. See:
http://blogs.msdn.com/david.wang/archive/2006/04/13/IIS7_Product_or_Platform.aspx

Yes, with Windows Server 2003 SP1, you can use SSL with Host headers, with the obvious caveats:
- For a given IP:Port which varies by Host header, the SAME SSL Server Certificate must be returned (remember, we still need the Host header to determine the right website's Server Certificate to use for SSL, but we need to negotiate SSL to first decrypt and obtain the Host header)
- Since Certificate Authorities cannot give out wildcard domain SSL Server Certificates, you cannot use this to host *.com domains. However, subdomains should be easy (subA.domain.com and subB.domain.com).

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Sat, 29 Apr 2006 09:44:32 GMT

maurits - Details, details... :-)

Since .bat is not recognized by IIS as an executable extension, it is really the same as ASP from an IIS-perspective (i.e. it is a ScriptMapped scenario).

In particular, .bat extension has to be ScriptMapped to CMD.EXE to function, and CMD.EXE has extremely tight security checks and is a huge additional dependency that is not present in the simple "run NET.EXE as a CGI by IIS" use.

However, the nice thing is that the .bat file is executed under CreateProcessAsUser().

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Sat, 29 Apr 2006 10:00:07 GMT

jvierra - The approach of executing FSUTIL.EXE with objShell.Exec() would execute FSUTIL.EXE using CreateProcess(), which uses the process identity and not impersonated identity. This means that if you:
1. configure the Application Pool to be Network Service
2. enable authentication
3. an Administrator logs in to run this ASP page

It STILL gets run as "Network Service" instead of Administrator - probably not what you expected.

Meanwhile, if you use ADSI/WMI from Script, they would most likely use the impersonated identity (unless the code internally does RevertToSelf()).

I am not certain that .NET 2.0 makes it any easier/better because System.Management is just a managed code layer sitting on top of WMI, which is all native code.

RE: delegation - that has NOTHING to do with the web server nor technology and everything to do with security basics. Just because I authenticated to the web server to execute an ASPX page does NOT mean the web server can take and use my identity to contact my bank electronically and withdraw my money from my bank account as ME.

Also read this blog entry:
http://blogs.msdn.com/david.wang/archive/2005/07/06/SSO_ISAPI_Considerations_2.aspx

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jvierra — Sat, 29 Apr 2006 15:28:49 GMT

David -

According to the Webcast wildcard certificates CAN be used with SP1. I am just getting ready to try this on a test server. Somtime next week I hope.

Part of the main theme of the webcast is "using wildcard certs" for cross site security.

Is it possible the the Webcast is wrong. The demo appears to work.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jvierra — Sat, 29 Apr 2006 15:50:19 GMT

David - My point with using WMI/ADSI is that it is easier to manage the code ubder ASP and can execute in the users security context for MOST things that admins want to see.

Two problems come up when trying this.

1. Non-admin users can't execute most WMI and some ADSI requests.
2. WMI queries against remote machines will only work if the IIS machine is "Trusted for Delegation" in AD.

Of course if you run the web site under administrative credentials some of these things can be circumvented but that is never a good choise in my mind.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jvierra — Sat, 29 Apr 2006 16:05:01 GMT

ADDENDUM to previous comment:

For clarity I want to add that this will only work WITHIN the domain and using "Integrated Security".

David - your blog on SSO/XAPI was excellent and should be helpful in settling issues of "how" and "why" authentication works and doesn't work.

Interesting Finds (oS edition) 2006/04/28

Jason Haley — Mon, 01 May 2006 09:55:57 GMT

HOWTO: Access POST form data with ISAPI

David Wang — Thu, 11 May 2006 11:39:11 GMT

This is a frequently asked question about IIS6 extensibility - how to access the request entity body...

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

PL — Sun, 14 May 2006 14:10:10 GMT

Not sure why this blog is so classic ASP centered, this and most things today is best solved with ASP.NET.

For example to launch processes on the server and retrieve the result you simply do this:

1. Make sure the ASPNET user has enough priviliges, meaning if you want to copy files or anything you need to set that up on the server.

2. Some programs require desktop access, to enable this for ASP.NET worker processes double click the WWW publishing service and under Logon check the box that says "allow interaction with desktop". If the process doesnt launch at all this is the thing you need to do.

3. Use a page like this:

<%@ Page LANGUAGE="C#" CODEPAGE="65001"%>

<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>

<script language="C#" runat="server">

protected void RunCommand(object sender, EventArgs e)
{
string sCommandTool = @"E:\daten\batch\test.cmd";
string sCommandArguments = "";

string sOutput = "";

try
{
using( Process p = new Process() )
{
p.StartInfo.UseShellExecute = false;
p.StartInfo.RedirectStandardOutput = true;

p.StartInfo.FileName = sCommandTool;
p.StartInfo.Arguments = sCommandArguments;

p.Start();

sOutput = p.StandardOutput.ReadToEnd();
p.WaitForExit();
}

litrOutput.Text = sOutput;
}
catch (Exception ex)
{
litrOutput.Text = "Error: " + ex.Message;
}
}

</script>

<html>
<body>

<form runat="server">

<asp:Button id="btnRun" runat="server" OnClick="RunCommand" Text="Run !"/>

<p>

<pre><asp:Literal id="litrOutput" runat="server" EnableViewState="False"/></pre>

</form>

</body>
</html>

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Sun, 14 May 2006 14:58:56 GMT

PL - I prefer ASP because it is simple, cleanly illustrates the issue, and allows me to explain what is going on without all the fluff. I am interested in explaining the underlying concepts and issues which stay valid through time, and not whatever is the latest and hotest technology.

ASP.Net can only obscure the issue because it involve the Managed Code layer as a system... when we ultimately only care about the Win32 function calls generated by that system

FYI:
1. What you just wrote in ASP.Net is much shorter in ASP.
2. Since the issue has nothing to do with ASP or ASP.Net but rather whether the code ultimately calls CreateProcess() or CreateProcessAsUser(), giving an ASP.Net-based solution does not seem fiiting.
3. My explanation can be equally applied to PHP, Perl, etc - while an ASP.Net-based solution without explaining the fundamentals only caters to the ASP.Net user.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

PL — Sun, 14 May 2006 21:00:05 GMT

Oh my good, you just wrote two pages about it but you claim it was shorter ?

I can make it shorter if you want me to:

<%
System.Diagnostics.Process.Start("whatever");
%>

I think you better buy a book about .NET, can't belive you work at MS.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Mon, 15 May 2006 02:28:23 GMT

PL - yo, chill... we're both on the same side, just have different approaches, hear me out.

I like to explain the details of what is going on so that anyone can apply knowledge to make their own decisions - critical thinking and problem solving - i.e. teach a man to fish, he will never go hungry

You mention another popular approach - pattern matching - just give me a working solution to the problem. Fast and to the point.

I am not saying that either is good/bad; everyone learns and teaches differently - so please be tolerent.

RE: Book about .NET

Me, I never need to buy a book about .NET; I already studied its core - MSIL / CLR - as well as the C# Specification. The .Net Framework is all applied stuff on top of the core. I don't need to buy a book - I just need to reflect on the DLL for its APIs and I am ready to go.

With your approach, one has to buy a book about .NET and every new Namespace/API because that is how you obtain new information when you do not know how the core really works.

Yes, my approach takes way more time (and pages) than yours, but that does not make either less valid. The objectives are different.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

James Vierra — Mon, 15 May 2006 03:14:42 GMT

David, PL,

Yes - youcan run a copy of an exe by altering the nature of IIS maknig it less secure and, yes, there might be a reason for doing this but I would question whether it is the best and safest approach.

CGI runs EXEs (Console Apps) just fine but on most servers it is disabled by default for a reason. If not set up carefully it can create a security issue.

COM is a better approach and more controllable. NET is even more configurable and potentially much more secure and powerful.

If you are just delivering text then HTML is probably the best solution. If you need to dio some simple server-side variable stuff then ASP is fine, easy and light weight.

If you need access to data and other more complex operations in a highly interactive way then NET is currently, in my opinion , the best solution yet.

Admins would like to run certain console applications under IIS for adminstrative convenience. Usually they want to run non-NET executables, batch files and scripts. This always runs into issues of output formatting and access authorization and authentication. More than any pervious technology NET 2.0 addresses many of these issues and provides good and secure methods for returning information to admins and users however there is a larger amount of setup overhead necessary to accomplish this.

Davids answer was more than I would have attempted. In my opinion if it doesn't run under IIS default setup then it shouldn't be run. NEt can accomplish a ping interface that is more flexible than running ping.exe and doesn't require altering the default strong security.

I love ASp book recommendations. I read anything that may add to my understanding of almost anything but nothing compares to teh knowledge that you get by being there at the birthing of a fundamental technology. Nothing compares to understanding the nuts and bolts that were used to build that technology. My funfdamentals still sit on top of the bit toggling and flip-flop wiring that I did way back when...

One question PL. What kind of an application would one build using the code you posted?

<%
System.Diagnostics.Process.Start("whatever");
%>

What would the "whatever" do and why would you do it that way as apposed to some more IIS-like way.

I am hoping you have an example that will make this useful knowledge because I spen some time running things this way and found that, for the process to be useful, I would need to hook it up to some form of input/output. This is not hard to do if we modify the code to grab the process object but then it becomes more like normal aspx NET programming.

Would you want to use this to start a service? How about to run a job? Well, in those cases, I would prefer other APIs designed for that so, then, what would we do with it.

Davids discussion of "Console Apps from IIS" was very enlightening to me. I had though I knew all of the ins and outs of this sort of thing but he put it all in a slightly new way which I found very helpful. It will come in handy.

However, you, PL, propose something that may also come in handy. I just don't see what it is at this point. I, too, need to run things remotely and have felt that IIS could be a big help in doing this. Anything that could make this easier would be appreciated.

Now for my question. David. What are your thoughts on using "middle-tier" objects with elevated permisions to allow users to read data from rpotected objects? There are security riskd in this I believe but some sort of guidance might help point the way to allowing admins a way to access protected resources through a web server without exposing the network to harm.

I know in other posts you have addressed this issue to some degree. It seems that the pieces may not have been drawn tightly together for this particular arena.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Jason — Mon, 15 May 2006 21:25:21 GMT

I've been bashing my head against the monitor trying to get something like this to work consistently. The issue I have is that i've pretty much turned my server into the definition of insecure by granting every know permission to every possible user/group. A simple asp script to launch something like notepad
<%
set objShell = Server.CreateObject( "WScript.Shell" )
objShell.Run( "notepad.exe" )
%>
will work perfectly until I logoff the server (i have IIS set to interact with the desktop so i can see the results). Once I log off, the asp page causes an application error on the server:
"The application failed to initialize properly (0xc0000142).."
However, this error will magically go away after a few minutes/hours - that is, until I log off again.

It seems like a permission error, but at this point an anonymous user from a kindergarten class could tell my server to format its hard drives. Argh.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Nigol — Wed, 09 Aug 2006 08:32:00 GMT

I've been reading this blog over and over again and it helped me a lot - thanks.
However, I'm still having trouble executing some commands from a CGI script (in Perl) when I'm not a user of the administrators group.

I created a web page where a CGI script executes the CVS command line tool. I also restricted this page to some users of our Windows domain by creating a local group (adding all required users to the group) and granting access only to this group.

If the user is as well within the local administrators group everything works fine. If the user is not in this group the command (and lots of others) is ignored.

Can you help?

Thanks very much,
Nigol

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Wed, 09 Aug 2006 09:20:47 GMT

Nigol - Did you read this link from this entry, which describes the behavior you observe?

http://blogs.msdn.com/david.wang/archive/2006/04/09/HOWTO_Run_Console_Applications_from_IIS6_on_Windows_Server_2003.aspx

I believe what you are seeing is that Perl launches commands using CMD.EXE, which only allows Administrators from IIS to use it on Windows Server 2003.

Thus, the issue is not that the command is "ignored" but that the command silently failed with access denied.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Nigol — Thu, 10 Aug 2006 03:07:19 GMT

Hi David,

Thanks very much for your reply. I had read the article you mentioned, but what I had done wrong was to set the ACL on the commands I wanted to execute (e.g. cvs.exe) instead of CMD.EXE !!!
Having set the ACL on CMD.EXE everything is working now.

Thanks once again,
Nigol

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Altex — Wed, 16 Aug 2006 10:52:10 GMT

I have IIS6 and PHP as ISAPI. I configured PHP to run as ISAPI module and configured application pool for it, so when i execute "whoami" from PHP i see "nt authority\local service".

But the problem is that to run any external console executables from php script i have to set exec&read permitions to cmd.exe for NETWORK SERVICE user. But script runs with LOCAL SERVICE permition. And if i remove NETWORK SERVICE permitions and ad LOCAL SERVICE permitions - then script cat not run external program because of insufficient rights.

Please, tell me how to configure IIS to run external programs from php (isapi) with local service user rights or what is wrong with cmd.exe permitions, why it needs network service permitions?

Thanks for help!

--

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

deandany — Tue, 22 Aug 2006 20:53:23 GMT

Great article... it removed some blocks in my head regarding security... however i still have not been able to solve my problem after reading this article.... the following code in VB.net web application raises a hidden "Access Denied" error...

Inside the batch file i am attempting foll. simple copy command
-----------------------------------
copy c:\test.log d:\test.log
EXIT
-----------------------------------

In Code i do this on asp.net-button click event

proc = New Process
workdir = String.Format("E:\")
proc.StartInfo.WorkingDirectory = workdir
proc.StartInfo.UseShellExecute = False
proc.StartInfo.FileName = filepath
proc.StartInfo.RedirectStandardError = True
proc.StartInfo.Arguments = "/c E:\test.bat"
proc.StartInfo.CreateNoWindow = True
proc.Start()
sr = proc.StandardError
While (sr.Peek <> -1)
sr.ReadLine()
End While

"sr.readline" consistently gives an access denied error inspite of
1) impersonation in web config
2)deny authorization=? in web config
3)anonymous access setting in Driectory Security in IIS5.0
4)assign Full control to all the directories/files i used in code using Cacls.exe
Can anyone solve this? the sample above is a simple test.. if this works i have several things to be done using batch files

Thanks in advance

Behappy,
deandany

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Thu, 24 Aug 2006 11:18:29 GMT

deandany - Your issue is described in the link I mentioned in the blog entry.

http://blogs.msdn.com/david.wang/archive/2006/04/09/HOWTO_Run_Console_Applications_from_IIS6_on_Windows_Server_2003.aspx

By default, batch file execution using CMD.EXE does not work from IIS6, no matter what you configure.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Nino — Mon, 04 Sep 2006 18:36:52 GMT

Can we to this on linux aswell ?

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Willis — Wed, 06 Jun 2007 01:59:47 GMT

Our administrators can not get php 5 to execute a shell command under win2003/iis6.

I don't see why the administrator is not allowed to configure the system so that a specific executable can be called from php.

It works on apache, but not 2003/iis6.

Is IIS6 capable of this?

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

ori — Thu, 20 Dec 2007 13:17:08 GMT

how can i use the CreateProcessWithLogonW() API function from vc6.0 without installing any .net /asp/c# packege on my IDE / computer/

(I understand it is essential to load a dll with this api, but this is the only thing I can use).

i need CreateProcessWithLogonW() to do silent log on (with my known username and password) to a remote desktop. (I am a win2000 professional client rdp). I wish to open the remote desktop programatically without the user password popup/window/input fields.

thenks

ori

kovacsio@hotmail.com

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Fri, 21 Dec 2007 06:37:58 GMT

ori - I don't understand your question. VC6.0 can directly call CreateProcessWithLogonW() API. No .Net/ASP/C# required.

For example, this is exactly what IIS6 does when it launches a w3wp.exe, and IIS6 has no .Net/ASP/C# code.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Fri, 21 Dec 2007 06:40:47 GMT

Willis - Administrators have an explicit Allow ACL on CMD.EXE to allow them to run shell commands. This is explicitly allowed by IIS6 and Windows Server 2003 security model.

You must have a system that locked down CMD.EXE or PHP is not running as Administrator to run shell commands. Something is wrong with your server.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

ron — Wed, 20 Feb 2008 22:46:33 GMT

Hi All,

I like all the discussions above, I used same way as following to load my application,

ProcessStartInfo startInfo = new ProcessStartInfo(@"C:\Program Files\Macromedia\FlashPaper 2\FlashPrinter.exe");

Process proc= new Process();

proc.StartInfo = startInfo;

startInfo.UserName = "Administrator";

startInfo.Password = _password;

startInfo.UseShellExecute = false;

startInfo.Arguments = ...;

proc.Start() ;

My problem is, when I use "Administrator" the codes working OK, when I use other kind of users (except "Administrator") or remove username and password, it is not working.

"Administrator" account is not allow to use in my application, can any one please tell me how to create a user which has a lower right as "Administrator", but still let the application works.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

ron — Wed, 20 Feb 2008 23:11:45 GMT

Hi David,

As my last post, my application is a traditional asp website, so I can not use web config or add <identity impersonate="true" userName="accountname" password="password" />.

I made properties to receive usernamse and password, the application is working OK only when user name is administrator, but I am requested to use a non-admin account.

Do you know how to fix it ?

Thanks.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Darwin George — Thu, 21 Feb 2008 23:53:33 GMT

I have a console application that aquires data from external equipment via ethernet packets and builds data files of the raw data then creates PCL/HPGL-2 print files from this data. I want to launch an external program, a PCL to PDF converter .exe, from within my console application. I am using cygwin to develop the app with and can't seem to locate the appropriate functions to allow me to launch the external .exe. Any suggestions for me.

deg@vidcoinc.com

Thank you.

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Fri, 22 Feb 2008 17:12:49 GMT

ron - You need to clarify whether FlashPrinter.exe requires the user to have administrative privileges.

Also, your code snippet is in .Net, but you say your application is traditional ASP website, so that seems to conflict. And if you want to run an application as another user, just use RUNAS.EXE and no need to use .Net.

As for how to run code using a specific user identity - the answer is linked off this blog post, so I shall leave that exercise to the reader.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Fri, 22 Feb 2008 17:14:45 GMT

Darwin - There are many ways to launch external programs in Win32, but since you want cygwin, I won't be able to help.

I suggest contacting cygwin support for your questions. This is a support forum for IIS/ISAPI related questions.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Joao — Wed, 27 Feb 2008 01:37:01 GMT

Hello David,

I have a problem that is exactly what you describe here. I want to execute cvs commands from a web application. I am using XP pro and IIS 5.1. What I do is call cvs using Process.Start() passing arguments in C#.

The CVS behaves exactly like the "net" command. Apparently it returns nothing. I have success running other things like ipconfig but not with cvs or net. That is, I can get the returned output.

My problem is that I'm not used to work with CGI/ISAPI and in IIS 5.1 I dont have the Web Services Extension so I am not quite sure How to get this to work.

I've searched everywhere and even tried to make a script in vbs that simply calls cvs and returns the output. But that behaves the same way.

Can you help me here? I'm starting to get despered! You seem to be by far the person who best understands this issue.

Thank you!

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Jan — Sat, 17 May 2008 19:46:48 GMT

Thanks David for te detailed information, was very helpful to get my CGI's working under IIS 60

Thank you

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

BobMonahon — Tue, 10 Jun 2008 03:24:28 GMT

Hello,

First, thank you for this write up. It's the first helpful document I've found. However, I'm still having a problem: from an ASP page, running under IIS 6 on Win2K3, I'm trying to execute a batch file that launches a vb-script. I get no error message, but nothing runs. Here is a stripped-down version of my code. (Replacing brackets with parenthesis to avoid HTML hiding the bracketted code)

ASP Page, located at (web root)\pye\pye_runload.asp

Dim oShell: set oShell = Server.CreateObject("WScript.Shell")

Dim zBatchFile: zBatchFile = Server.MapPath("..\bin\test_batch.bat")

Dim iReturn: iReturn = oShell.run(zBatchFile,1,false)

Response.Write "Batch launched, rc=" & iReturn

If the test_batch.bat runs, it creates an output file in the /bin/ folder. I gave write permissions to the necessary accounts.

The result on the ASP Page is: Batch launched, rc=0

But nothing runs - there is no output file.

If I run this: iReturn = oShell.run(zBatchFile,1,True)

It get this: Batch launched, rc=1

And again, there is no output file.

On my Dev machine (IIS 5, WinXP) the batch and vbs script run fine.

When I remote into the Win2K3 server and launch the batch from a cmd.exe window, it runs fine.

I went through your checklist, plus some of my own:

1. The web-site has "Parent Paths" enabled.

2. The web-site uses a domain account for anonymous access

3. The web-site has Read, Script, and Execute access turned on

4. ASP.DLL is enabled as a Web Services Extension

5. The web-site has a ScriptMaps property which associates .asp to ASP.DLL

6. I make the request to http://localhost/(website)/pye/pye_runload.asp

Plus..:

7. The Web-site Application Pool runs with a WAMUserName of the domain account

8. All of these accounts have Read and Execute (and Write) access to the /bin/ folder:

- the domain account

- IUSR_machine_name

- IWAM_machine_name

Still, nothing. To simplify, I copied cmd.exe into the /bin/ folder, and explicitly gave permissions to that copy of cmd.exe to the domain account and the IUSR_ and IWAM_ accounts. I put this in my ASP page:

ASP Page, located at (web root)\pye\test_batch.asp

Dim oShell: set oShell = Server.CreateObject("WScript.Shell")

Dim zBatchCmd: zBatchCmd = "D:\BudgetTest\bin\cmd.exe /c dir *.* > D:\BudgetTest\bin\test_batch.txt"

Dim iReturn: iReturn = oShell.run(zBatchCmd,1,True)

Response.Write "Batch launched, rc=" & iReturn

Result on the ASP Page is: Batch launched, rc=1

.. and, nothing happens. No output file is created.

Any help would be appreciated.

Regards, Bob Monahon

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Wed, 11 Jun 2008 05:35:38 GMT

BobManahon - CMD.EXE on Windows Server 2003 will not run when launched via Win32 CreateProcess() (that's what oShell.Run boils down to) from IIS6, unless the Application Pool Identity is LocalSystem or if the Application Pool's ProcessIdentity == Impersonated Identity from Authentication.

This pretty much prevents launching remote command consoles by hackers, as well as IIS scripts launching legitimate administration batch files.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

Faiz — Sat, 06 Sep 2008 10:37:13 GMT

Hey David,

Thanks a ton for the article.

One can also use processstartinfo class that is part of .net 2.0 to run process.

However as long as i dont give explicit user name and password it works fine taking the app pool identity.

But if i keep the app pool identity as network service and

give user id and password(secure string) to the processstartinfo

class it gives an exception "Application failed to initialize properly".

Any help on this will be greatly appreciated.

Thanks,

Faiz

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

monty — Fri, 19 Dec 2008 01:03:49 GMT

I am trying to run a batch file which in turn calls a vbs file from iis6 but its failing with permission error 800a0046 permission denied.

I have given permission to iusr_computer to run the file within iis all the extensions are allowed as this is behind a firewall and on the intranet and only used to display results of tests, in an attempt to automate the tests so they automatically restart is what I am trying to do.

my page

sendvuserend.asp only contains the following

<%@language=vbscript%>

set wschell=Server.CreateObject("Wscript.shell")

wshell.run "c:\restart.bat"

I don't understand why this doesn't work

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

David.Wang — Tue, 23 Dec 2008 11:06:01 GMT

monty - for security reasons, that is no longer allowed by Windows Server 2003 -- unless you match the Application Pool Identity to the Impersonated Identity, or if the Application Pool Identity is Local System (ultra-insecure).

It does not matter what permissions you grant, nor what you enable within IIS, etc.

//David

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

alan c. — Tue, 07 Apr 2009 23:09:41 GMT

hi david,

I'm building my first web app, and I've run into the scenario as described by joao. I've been scouring the web to see what information I can find, and through that I've come across your post. I'm building and testing my application on win xp pro that has IIS 5.1 ( hopefully that won't disqualify me from a response :)

Let me describe my issue, and my understanding from the context of your post...

In my application I call a batch file using an instance of System.Diagnostics.Process. The batch file calls the net.exe to map a drive on the webserver:

start net.exe use X: <some path to a network resource>

This is tied to a button click on my web application, and when its invoked, nothing happens. When I try variants of the batch file, like calling a vb script to generate a message box to make sure that the batch is called, I get errors with wscript or net.exe indicating that the application failed to initialize properly.

So from what you said this is what I understand:

1. Since net.exe doesn't conform to the CGI specification, I shouldn't attempt to run it directly, and I shouldn't waste time looking at that.

2. Since I'm using a batch file to invoke net.exe, IIS regards this as ASP. To get this to work, the extension needs to be scriptmapped to cmd.exe. (Done via application configuration of web app in IIS)

3. cmd.exe is strict with security, the bat file executes under CreateProcessAsUser(), and will probably require the appropriate credentials, and if I have impersonation setup properly that should be sufficient.

Could you confirm the above conclusions I made? Is that enough to get my bat file to work properly? I'm stuck right now, because I am blocked from creating new application extension mappings, so I can't move forward with my testing.

Also, by adding the mapping, are there some security issues I need to be concerned with?

The post by Maurits was a little to terse for me, (the opposite of this post) but do we even need to worry about the newline/carriage return if we're running net.exe scriptmapped?

re: HOWTO: Run Console Applications from IIS6 on Windows Server 2003, Part 2

jf — Tue, 17 Nov 2009 23:24:39 GMT

Great Article.

Thank you.

I can make this work for everything but shutdown -s -t 25 from xp pro 64 bit running php 64 bit with fastcgi under iis 64 bit.

Any pointers?