Care, Share and Grow! : service startup

WWW Service not listed in the Services console (IIS 6.0)?

Saurabh Singh — Fri, 23 Oct 2009 00:33:47 GMT

This post is a continuation to the series on IIS service startup issues. I did not feel like writing it since we haven’t seen much cases on this type of behavior and I thought this could be one of those rare issues which always happens with IIS but my customer who bore the brunt of trying to reinstall IIS multiple times without luck virtually forced me into writing it. So here I go…

Problem Description

IIS gets installed successfully on a fresh Win2k3 Server. IISADMIN service is up and running. However we do not see World Wide Service (WWW) listed in the Services console. Hence we cannot start any website.

Resolution

If you are seeing a similar behavior as above you may want to follow the steps below.

1. Check for the default permissions as per this KB on

<SystemDrive:>\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys.

2. Open iis6.log from the location <SystemDrive:>\Windows and look for

OC_COMPLETE_INSTALLATION:iis_www:SetupInstallServicesFromInfSection failed.Ret=5

*Return code 5 suggests access denied

……………………………

OC_CLEANUP:InetStartService():ServiceName=W3SVC unable to start

WARNING. Err=0x424

OC_CLEANUP:!FAIL!

OC_CLEANUP:PostInstall of Component 'iis_www' FAILED

3. This suggests we are having some permission issues while installing IIS.

4. Download and run the Process Monitor tool from here while reinstalling IIS again from the Add/Remove Components wizard. Ensure we run it only during the install process since it collects a lot of data.

5. Check for any ACCESS DENIED entry in the log captured by the Process Monitor tool.

6. You may see an ACCESS DENIED for the Registry key

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost.

Using the Process Monitor tool you can get the identity which does not have the permission. Generally it will be the current logged on user’s credentials running the wizard. Grant Full permission to the Administrators group (assuming that this user trying to install IIS is also a part of this group).

7. Reinstall IIS and hopefully you should be good.

If this does not help Microsoft PSS support for IIS is always there to help you out ;-)

Good Luck!!

FTP changes not taking effect in IIS 7.0?

Saurabh Singh — Fri, 21 Nov 2008 23:47:53 GMT

I was working on an FTP issue the other day on IIS 7.0 and I missed something very basic which could have resolved my issue way back had I noticed the nuances of this new model. Normally people tend to go ahead with restarting IIS services for some changes done in the configuration to make sure everything is fresh. Like running IISRESET from the cmd prompt or Restarting IIS services from the IIS manager itself. But in IIS 7.0 if you want to restart FTP services ensure you don't go by the above. This will restart IISADMIN, WAS and W3SVC services but not FTPSVC. IIS 7.0 OOB Secure FTP module runs under a separate process Svchost.exe. So doing an IISRESET won't help for FTP changes to take effect.

Ensure you run these two commands instead:

Start -> Run -> cmd

At the cmd prompt:

>net stop ftpsvc
The Microsoft FTP Service service is stopping.
The Microsoft FTP Service service was stopped successfully.

>net start ftpsvc
The Microsoft FTP Service service is starting.
The Microsoft FTP Service service was started successfully.

Hope this helps one who may have unnoticed this change.

Some tips if your IIS 6.0 World Wide Web Service (WWW) ever goes down...

Saurabh Singh — Fri, 25 Jul 2008 18:09:55 GMT

Well, every time I try writing some thing different than IIS and for some reason I come back to it :-)

Here is a quick troubleshooting tip for a scenario where World Wide Web service on my test IIS 6.0 box went down for no apparent reason. Here is what I started seeing when we tried to start all IIS related services. IIS ADMIN service came up fine but I wasn't lucky enough with WWW

From the Services console I got this error message when tried to start WWW service:

Now this was weird, I remember everything was fine just few minutes ago. I wondered how we could resolve the issue.

Event log showed the following:

Event Type:    Error
Event Source:    Service Control Manager
Event Category:    None
Event ID:    7023
Date:        7/25/2008
Time:        6:59:50 AM
User:        N/A
Computer:    SAURABSI-SEC
Description:
The World Wide Web Publishing Service service terminated with the following error:
Access is denied.

Now, this started making some sense. It was quite apparent that there was a permission issue. But then I was a local admin on the box and I had not changed any file permission recently, at least not in the last few minutes for sure.

I tried running Process Monitor from www.sysinternals.com. It is a handy tool to troubleshoot permission issues. Unfortunately I couldn't see any ACCESS DENIED anywhere in the log collected via this tool. Now if there was no access denied anywhere what else could have led to such an error message!!!

I ran DebugView while reproducing the WWW startup issue.

It showed the following:

I noticed this in the above log:

Now it was clear that there were no issues as far as accessing this metabase file was concerned. Had there been a permission issue to access this file it should have been captured by the Process Monitor utility. Also since IISADMIN was up and running it was sure that metabase was fine and was accessible. I wondered if there was something within this file, maybe some key/property etc. which was giving the problem.

I went ahead with Metabase Explorer (also called as MBExplorer, part of IIS 6.0 Resource kit) and tried to read through the various hierarchy in the metabase. The moment I tried to launch MBExplorer it gave the following error:

This was getting interesting now :-). I clicked on Yes and launched the utility anyway.

While scanning through the various structures within MBExplorer I got another similar alert when I reached the following location:

I knew now that this subkey was having the permission issue for sure. However I could not even import this setting from any other machine since I could not even rename the key !!

Looked like even administrator account had no permission on this key. It could not even be inherited from its parent level using MBExplorer.

So, after some thought this is what I did. Stopped IISADMIN service and opened metabase.xml file in a notepad.

Found the section which described the Filters subkey properties as shown below:

The only way to change the ACL on this key was to remove the AdminACL attribute such that it would inherit the same from its parent level, i.e. W3SVC level in the above MBExplorer window. I deleted the above AdminACL attribute completely, saved the file and gave a restart with my fingers crossed ;-). I had a backup.

Hurray!!! this is what I got finally.

Later on, found that while playing with permissions for compression filter, accidentally the ACL permissions for Administrators and IIS_WPG was removed, and I was a member of both these two groups :-(

Finally all that ends well is well, I am a happy man now .

Hope this helps someone stuck in a similar situation...

Cheers

Change in IIS MMC setting may cause unwanted restarts of W3SVC

Saurabh Singh — Tue, 22 Apr 2008 23:31:11 GMT

Recently we have discovered an issue with IIS Manager wherein changing settings in a certain way may cause unexpected restart of World wide Web Publishing Service. And this may happen before you realize until you go back to the Application event log and find entries corresponding to the W3SVC restart event as shown below:

Event Type:    Information
Event Source:    ASP.NET 2.0.50727.0
Event Category:    None
Event ID:    1023
Date:        4/22/2008
Time:        6:35:20 AM
User:        N/A
Computer:    SAURABSI-SEC
Description:
Restarting W3SVC

Event Type:    Information
Event Source:    ASP.NET 2.0.50727.0
Event Category:    None
Event ID:    1025
Date:        4/22/2008
Time:        6:35:25 AM
User:        N/A
Computer:    SAURABSI-SEC
Description:
Finish restarting W3SVC

Also as part of the above symptom, you will see IIS mmc paused like in a hung state (you may see a transient hour glass).
So what are the steps you need to be cautious of especially in a production environment?

First, a little background...

If you intend to change the version of ASP.Net through IIS manager by going to the Web Site properties --> ASP.Net tab, you should be fully aware that W3SVC service will get restarted in order to reflect the change. Restarting of W3SVC will lead to all the application pools getting recycled along with it, hence leading to all your currently running web applications to spawn new worker processes for further requests. This is by design and if you want to circumvent the recycling of other application pools not corresponding to your website, you should have a way to control W3SVC restart after the version change. You can do so by following this excellent post by Jerry Orman.

So far so good. But I have something else to disclose too.

Let's say you go to the IIS manager, select a Web site, go to its properties and poke around with different settings. At some point you visit ASP.Net tab (even if you do not modify any settings like current ASP.Net version) and move out from there to some other tab. On this tab if you do any change(s), and you click on Apply and then OK (in the same order) bang!, your W3SVC service will restart and all your application pools will recycle subsequently as a result of it.

Here are some quick steps to reproduce the problem, follow it to believe it.

1) Open IIS manager (Start -> Run -> inetmgr.exe)
2) Select any website --> right click and select properties
3) Click on ASP.NET TAB - do not change or modify anything - just click on the TAB.

4) Now click on any other TAB and change some values (for example: go to website tab and change port to say 8080 from 80)
5) Hit apply
6) Hit OK
7) This will restart W3SVC and you will see following event in application event logs.

In the above steps the key points are basically to visit the ASP.NET TAB and then click on Apply and then OK to reproduce the issue.

Why is this behavior?
===================
The reason this behavior occurs is in the code where we make a check to see if ASP.NET runtime version is changed and if yes we need to fire W3SVC restart. We are comparing the selected version of ASP.NET TAB with what has been changed incorrectly. There is an additional code in place that checks for the QFE versions of the ASP.NET framework installed, but in the IIS manager UI, we only give an option to either select 1.x.xxxx or 2.0.xxxxx. We really don’t care about the QFE versions installed after that. But the code that gets executed on OK or APPLY does. For the 1st execution (i.e. click on APPLY) it’s correctly able to remove the QFE information from the version string it retrieved (i.e. 2.0.xxxxx, instead of 2.0.xxxxx.QFE), the check is successful noting that nothing is changed in ASP.NET TAB, and hence no restart of W3SVC is required. But now when we go ahead with 2nd execution (i.e. click on OK) the same code executes again and this time the version information string is truncated further to RTM (i.e. to 2.0 from 2.0.xxxxx) and thus the check fails (ASP.Net version is changed from 2.0.xxxxx to 2.0), which incorrectly indicates that ASP.NET runtime version has been changed and thus calls a restart of W3SVC.

In short, you could click anywhere in UI all day long, but for you to reproduce this issue, you need to
1) Go to ASP.NET UI once.
2) Click APPLY and OK (both in that order). If you only click OK then the code gets executed only once and hence correctly and would not restart the w3svc.

Latest update on this:

We have informed the Product group about this issue. A Knowledge base article is in work.

Laterz!
Saurabh

IIS ADMIN service fail to start?

Saurabh Singh — Thu, 02 Aug 2007 03:17:00 GMT

An issue that causes a lot of headache to Web Admins is when IISADMIN service does not start up for no reason.

Here are a quick troubleshooting steps you can do before you look around and yell for help or call into Microsoft Product Support services and shell out some $$.

-- Check and Make sure we have a Metabase.bin file (in IIS 5/5.1) or Metabase.xml file (in IIS 6) in C:\<%Windows%>\system32\inetsrv folder.

-- Check and make sure that we have a Machinekey starting with “C23” in the C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder.

-- Make sure that the MachineKeys folder has Full Control for both Administrators and System. Make sure that the “C23” key has "Administrators" and "System" Full Control permissions set on it.

IIS depends upon this key for encryption/decryption of metabase keys. If we do not have the required permissions IISADMIN won't be able to read the configuration from the metabase without this key and hence will fail to start.
(Just out of topic but, remember even for SSL you should have the above permissions because it too depends upon a machinekey in the same folder for cryptographic computations).

Ensure you have the necessary permissions according to the following KB http://support.microsoft.com/kb/278381/en-us

If the issue doesn't get resolved after checking the permissions continue reading further.

-- Check and see if you have multiple instances of the “C23” key identified above in the MachineKeys folder.

a. If you have only one instance, then check and make sure that the date on that key matches the date from the time when IIS was installed on the server. If the date is newer than the last IIS Install date, then the MachineKey that was used to encrypt the Metabase got lost and you would have to re-Install IIS (if you don’t have the MachineKey backed up anywhere).

b. Or else you can look at the suffix of the C23 key (the entire length that follows ‘_” in the C23 key) and check if it is different from any of the suffixes for other keys in the container. This means that the MachineKey (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGUID) for the machine
has changed since IIS was last installed on the machine. If you don’t have a second instance of the “C23” key (with an earlier date with a different Suffix) at this point, then you have lost the original MachineKey and would have to reinstall IIS. If you do have the earlier (older) key, then replace the suffix of the older key with the MachineGUID value found in the registry and delete the newer key. You should be able to restart IISADMIN at this point. For IIS 5 you can apply this fix (http://support.microsoft.com/default.aspx?scid=KB;EN-US;884872)
Remember that this does not fix the IISADMIN service startup problem, but prevents the C23 duplicate issue from happening again (which might be the cause of IISADMIN startup issue).

"When IIS starts it uses the registry value HKLB\software\microsoft\cryptography\MachineGUID to build the filename identifying the keyset file:
<%allusersprofile%\Application Data\Microsoft\Crypto\RSA\MachineKeys\c23***********************_machineGUID>
This keyset is then used to validate the SessionKey in the metabase(.bin\.xml) and later to En/Decrypt the applicable metabase entries.
These parts need to be in synchronization to get a successful IISAdmin startup"

-- Finally if the above steps do not help you can use MSCONFIG (Start->Run->MSCONFIG) to disable all the third party (Non-Microsoft) services and see if that helps in starting the IIS Services. If you can, then you need to start enabling the third party services one by one to figure out which one is the culprit here. If a 3rd party service is the cause you may get in touch with the vendors to get this addressed.

Additional Recommendations:

Ensure that you backup the metabase.xml (or metabase.bin) on a regular basis. A better way is to keep a transferable copy of the IIS 6.0 metabase backed up with a password. This allows the encrypted information to be decrypted and stored in a manner that allows for portability. The full procedure can be
found here:
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/131b609d-ff3a-488f-a8dd-13044fa623a1.mspx?mfr=true

Ensure that the machine keys are also backed up in the full system backup jobs.
http://support.microsoft.com/kb/246459/en-us

Hope this helps....