AccessDenied Exception on AppPool properties, cannot call ApplPool.Recycle() - C# - c#

Running on Windows Server 2012 R2 Standard, with IIS 8.5.9600
In C#, after setting up a site, I'm retrieving the DefaultAppPool from the site.
Upon retrieval of the pool, the following properties have exceptions on them:
appPool.State:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
appPool.WorkerProcesses
at Microsoft.Web.Administration.Interop.IAppHostElement.get_Collection()
at Microsoft.Web.Administration.ConfigurationElement.GetCollection(String collectionName, Type collectionType)
at Microsoft.Web.Administration.ApplicationPool.get_WorkerProcesses()
So I cannot call
AppPool.Recycle()
It throws this exception:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
at Microsoft.Web.Administration.Interop.IAppHostMethodInstance.Execute()
at Microsoft.Web.Administration.ConfigurationMethodInstance.Execute()
at Microsoft.Web.Administration.ConfigurationElement.ExecuteMethod(String methodName)
at Microsoft.Web.Administration.ApplicationPool.Stop()
at EBI.Core.Common.WebHelper.IISHelper.AddApplicationIis7(String serverName, String applicationPool, String siteName, String applicationPath, String virtualDirectoryPath, String physicalPath, String defaultPage, Int32 deploymentType, String siteUrl)
Online research says to add high privileges to this folder:
C:\Windows\System32\inetsrv\config
So I have increasingly added the following:
SYSTEM
Administrators
IIS_IUSRS
INTERACTIVE
NETWORK
SERVICE
DefaultAppPool
NETWORK SERVICE
CREATOR OWNER
IUSR
BUT STILL SAME ERRORS.
It's probably a bad idea to add all those rights to that folder, so perhaps there is something else I might be missing, but I cannot find what it is. Any ideas?
Thanks for any help!

Whether you are trying to access the app-pool from any console application or windows service? If so then the console application or windows service should be executed with a username which has admin rights on the server. The username should also be part of IIS_WPG group. May be I have got your question totally wrong.

If using c# code and deploying to IIS Server then running AppPool.Recycle() can generate 'Access is denied' error.
Visit the application pool you are running the c# code under, and go to advanced Settings -> Identity and change the Identity to 'Administrator' or some user with Admin rights.

Related

C# Start/Stop IIS Application pool programmatically with Access Denied issue

I'm trying to simply start/stop the application pool in IIS programmatically in C# in the following code:
ServerManager serverManager = new ServerManager();
ApplicationPoolCollection appPools = serverManager.ApplicationPools;
foreach (ApplicationPool ap in appPools)
{
if (ap.Name == "Test App")
ap.Start();
}
I already added the assembly Microsoft.Web.Administration in the project.
And I also gave the full permission for user "IIS AppPool\DefaultAppPool" in the folder C:\Windows\System32\inetsrv\config. (Before giving this permission, it's not even able read the application pool name.)
However, it's still throw an exception when it's trying to start the application pool.
An unhandled exception of type 'System.UnauthorizedAccessException' occurred in Microsoft.Web.Administration.dll
Additional information: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
What else permission should I need to add for fixing it? Thanks.

Windows service access to UNC path

I have a windows service written in C# running on Windows Server 2012. The service is running as a domain user with permissions on the local machine and NTFS permissions to shared network resources
can access shared files and directories in Windows Explorer when logged on as this user
I reboot the server, the file system calls succeed at first. Then after some amount of time, or after accesses to the same file path from that computer, the programmatic calls will start to fail and will never spontaneously succeed again. Rebooting the server fixes the issue for a very short while.
I referred
Windows service cannot access UNC path
I am facing the same issue as in the above link. But the network share is between Windows server 2012 R2 and another server with same OS.
Exception stack trace :
MESSAGE:
An unexpected network error occurred.
STACK TRACE:
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.FileSystemEnumerableIterator1.MoveNext()
at System.Linq.Enumerable.Any[TSource](IEnumerable1 source)
Can anypne please help?

Using C# to administer IIS

I would like to create an app that will deploy a website. Basically, I just want this app to copy the publish files to the webserver in a new folder, change the website to that folder, then recycle the app pool.
I found out that I should be able to do this with Microsoft.Web.Administration. I am having a problem with even the most basic task as I'm learning how to do this. here is my code in a windows form app to just play with this.
try
{
using (Microsoft.Web.Administration.ServerManager sm = Microsoft.Web.Administration.ServerManager.OpenRemote("webservername"))
{
foreach (var site in sm.Sites)
{
MessageBox.Show(string.Format("{0}", site.Name));
}
}
}
catch (Exception ex)
{
MessageBox.Show(ex.ToString());
I'm simply trying to loop through the websites and display the names as my first try. The error I get is the following:
System.InvalidCastException: Unable to cast COM object of type 'System.__ComObject' to interface type 'Microsoft.Web.Administration.Interop.IAppHostWritableAdminManager'. This operation failed because the QueryInterface call on the COM component for the interface with IID '{FA7660F6-7B3F-4237-A8BF-ED0AD0DCBBD9}' failed due to the following error: Interface not registered (Exception from HRESULT: 0x80040155).
at Microsoft.Web.Administration.ConfigurationManager.CreateAdminManager[TClass,TInterface](WebConfigurationMap webConfigMap, Boolean isAdminConfig)
at Microsoft.Web.Administration.ConfigurationManager.CreateWritableAdminManager(WebConfigurationMap webConfigMap, String configPathToEdit, Boolean isAdminConfig)
at Microsoft.Web.Administration.ConfigurationManager.CreateConfiguration(WebConfigurationMap configMap, String configPathToEdit, Boolean isAdminConfig)
at Microsoft.Web.Administration.ConfigurationManager.GetConfiguration(String rawConfigurationPath, String cacheKey, Boolean isAdminConfig)
at Microsoft.Web.Administration.ConfigurationManager.GetApplicationHostConfiguration()
at Microsoft.Web.Administration.ServerManager.GetApplicationHostConfiguration()
at Microsoft.Web.Administration.ServerManager.get_SitesSection()
at Microsoft.Web.Administration.ServerManager.get_Sites()
The line that errored is:
foreach (var site in sm.Sites)
I've tried this with both my local IIS8 express and a windows server 2008 IIS 7.5
What have I done wrong?
You may want to check the following points:
The Name of the server. If not sure try looking for in your IIS Management
The version of the .dll is the right for your version of IIS.
The .net framework version. Since it use System.Web it depends on full-version of the .net framework but not on the Client Profile subset.
The machine on which the code is executing needs to have the IIS Management Scripts and Tools Windows feature installed.
On a Windows client OS or on Windows Server 2008 R2 and earlier, you can install it via the following steps:
Open Control Panel > Programs > Turn Windows features on or off.
Drill down to Internet Information Services > Web Management Tools and check IIS Management Scripts and Tools.
You are trying to manage a remote server, so
The account runs the code must be the local administrator of that remote server.
The DCOM ports must be opened at firewall.

Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) on local pc

i am using fully asp.net configured site i take it from this link
http://www.codeproject.com/Articles/37660/Fully-configured-ASP-NET-Membership-Website-Templa
as a template to my project, all what i did is changing the conection string on the web.config file to point to my database
<connectionStrings>
<add name="AspNetMembershipTemplateConnectionString" connectionString="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Members.mdf;Integrated Security=True;User Instance=True" providerName="System.Data.SqlClient"/>
</connectionStrings>
and i run the project locally , but the problem that when i debug it it show this error
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
i google it , and i found that happen because of the privileges but i am using my user and its administrator account , how can you help me with this problem?
You are probably having the code in a folder that the IIS account can't access. Move to the wwwroot/Inetpub folder or grant appropriate privileges to the IIS service account for the folder where the code is in.
Edit
I was just reading the exception in the image. When you read the exception thoroughly you will even see that it suggests to edit the privileges.
i use the project in my local pc without needing to use IIS , so i solve this by close VS2012 and reopen it as administrator .. and its work fine

Allowing Access To Outlook Interop In Web Forms Project

I am having a problem with IIS permissions and Microsoft's Outlook 2010 interop assembly using a web forms project.
I created a proof of concept project to make sure I could use Microsoft's Outlook interop assembly in a particular the situation I am tasked with. The demo project worked great and I had no problems. Now I am trying to integrate it into our main project and I am running into an IIS permission issue. I have my web site running in IIS 7 locally. In IIS Manager, I click on Application Pools -> My Web Site -> Advanced Settings. In this window, I have a custom Identity called "fileshare" with a password ("fileshare" was create to secure access to the web site's images, pdf files, etc. on a development network server). I copied the outlook interop assembly into our common shared assemblies folder instead of referencing it from the GAC. I gave the assembly all permissions for IUSER, NETWORK SERVICE, IIS_WPG, ASP.NET and fileshare. I get the following run- time error:
Retrieving the COM class factory for component with CLSID {0006F03A-0000-0000-
C000-000000000046} failed due to the following error: 80070005 Access is denied.
(Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)). Description: An unhandled
exception occurred during the execution of the current web request. Please
review the stack trace for more information about the error and where it
originated in the code.
Exception Details: System.UnauthorizedAccessException: Retrieving the COM class
factory for component with CLSID {0006F03A-0000-0000- C000-000000000046} failed
due to the following error: 80070005 Access is denied. (Exception from HRESULT:
0x80070005 (E_ACCESSDENIED)).
ASP.NET is not authorized to access the requested resource. Consider granting
access rights to the resource to the ASP.NET request identity. ASP.NET has a
base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on
IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that
is used if the application is not impersonating. If the application is
impersonating via <identity impersonate="true"/>, the identity will be the
anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET access to a file, right-click the file in Explorer, choose
"Properties" and select the Security tab. Click "Add" to add the appropriate
user or group. Highlight the ASP.NET account, and check the boxes for the
desired access.
I checked the windows event logs and under Windows Logs -> System and I have this error:
The machine-default permission settings do not grant Local Activation permission
for the COM Server application with CLSID {0006F03A-0000-0000-
C000-000000000046} and APPID Unavailable to the user BSoup\fileshare SID
(S-1-5-21-2999627215-1482540357-33300828-1019) from address LocalHost (Using
LRPC). This security permission can be modified using the Component Services
administrative tool.
After doing a bit more research, I've decided that using the interop assembly is a bad choice. As Alexi stated, it's not for use over the network.
Start Internet Information Services (IIS).
Right-click your application's virtual directory, and then click Properties.
Click the Directory Security tab. Under Anonymous access and authentication control, click Edit.
Make sure the Anonymous access check box is not selected and that Integrated Windows authentication is the only selected check box.
Configure ASP.NET to use Windows authentication with impersonation, use the following configuration in WebConfig.
<system.web>
<authentication mode="Windows"/>
<identity impersonate="true"/>
</system.web>

Categories

Resources