Remote Debugging Across Domains

Switch View

Remote Debugging Across Domains

Collapse All

This page is specific to

Microsoft Visual Studio 2008/.NET Framework 3.5

Other versions are also available for the following:

Visual Studio Debugger

Remote Debugging Across Domains

This topic applies to:

Edition	Visual Basic	C#	C++	Web Developer
Express
Standard
Pro and Team

Table legend:

	Applies
	Does not apply
	Command or commands hidden by default.

Remote debugging involves two-way communication between the Visual Studio 2005 debugger and the Remote Debugging Monitor (msvsmon.exe). For remote debugging to work, it is important what user runs Visual Studio and also what user runs msvsmon.exe.

To connect to msvsmon, Visual Studio must be run as the same user running msvsmon or as an administrator. (You can also configure msvsmon to accept connections from other users.)

Visual Studio accepts connections from msvsmon if msvsmon is running as a user who can be authenticated on the Visual Studio computer. (The user must have a local account on the Visual Studio computer.)

With these restrictions, remote debugging works in various scenarios, including the following:

Two domains without two-way trust
Two computers on a workgroup
One computer on a workgroup, and the other on a domain
Running the Remote debugging monitor (msvsmon) or Visual Studio as a local account

So, you must have a local user account on each computer, with the same user name and password on each computer. If you must run msvsmon as a different user than Visual Studio, then you have to have two user accounts on each computer.

A domain account can map to a local account. Therefore, you can run Visual Studio as a domain account if the domain account matches the name and password of a local account on each computer.

For Windows XP Professional computers on a workgroup, the local security setting may prevent remote debugging. The policy must be set to Classic for remote debugging to work. (This concern does not apply to computers that are running Windows 2000, Server 2003, or Windows XP computers that are joined to a domain.)

To change the security policy to allow remote debugging between domains (Windows XP Professional)

On the local computer, choose Control Panel on the Start menu.
In Control Panel, double-click Administrator tools.
In the Administrative tools window, double-click Local Security Policy.
Under Security Settings, open the Local Policies folder.
In the Local Policies folder, select Security Options.
In the Policy column, find Network access: sharing and security model for local accounts and double-click it.
In the Network access: sharing and security model for local accounts dialog box, change the setting from Guest only - local users authenticate as Guest to Classic - local users authenticate as themselves and click OK.
Close the window and restart the computer.

Repeat steps 1 to 8 on the remote computer.

You can now do remote debugging using the same user name on both computers.

Caution:
Changing the security model to Classic can result in unexpected access to shared files and DCOM components. If you make this change, a remote user can authenticate with your local user account instead of Guest. If a remote user matches your user name and password, that user will be able to access any folder or DCOM object you have shared out. If you use this security model, make sure that all user accounts on the computer have strong passwords or set up an isolated network island for the debugging and debugged computers to prevent unauthorized access.

Caution:

Changing the security model to Classic can result in unexpected access to shared files and DCOM components. If you make this change, a remote user can authenticate with your local user account instead of Guest. If a remote user matches your user name and password, that user will be able to access any folder or DCOM object you have shared out. If you use this security model, make sure that all user accounts on the computer have strong passwords or set up an isolated network island for the debugging and debugged computers to prevent unauthorized access.

Other Resources

Remote Debugging Setup

Tags

: Add a tag

Flag as ContentBug

Unable to connect

MarcK02 | Edit | Show History

After following all the above instructions, I continue to experience an error when attempting to debug the Windows 2008 IIS remote server w3wp.exe process.

See error below.
---------------------------
Microsoft Visual Studio
---------------------------
Unable to attach to the process. The Visual Studio Remote Debugger (MSVSMON.EXE) has insufficient privileges to debug this process. To debug this process, launch the remote debugger using 'Run as administrator'. If the remote debugger has been configured to run as a service, ensure that it is running under an account that is a member of the Administrators group.
---------------------------
OK
---------------------------

Performed the following steps:

Start VS 2008 remote debugger as local admin account.
Login to VS2008 client as local admin account. Using same exact username and password as remote server.
Successfully able to connect to the remote server and list all running process.
Error obtained after attempting to attach to the w3wp.exe process.

Please advise.