Applications Are Denied Access to Resources
After a clean install, IIS 6.0 runs in worker process isolation mode. Applications running in this mode use the Network Service identity, by default. Network Service is an account with few user rights and therefore provides better security by restricting access to resources on the Web server. If you migrate applications to IIS 6.0 while the server is in worker process isolation mode, and if your applications previously ran in-process (in Inetinfo.exe) as LocalSystem, the applications may fail to access resources because of the restrictions set forth by the Network Service identity. The LocalSystem account has access to almost all resources on the operating system, and therefore creates serious security implications. You should avoid using the LocalSystem account when possible. If it is absolutely necessary to use the LocalSystem account on an application, run that application in a new application pool in its own virtual directory so you can reduce the attack surface by isolating the application. As an alternative, and if your application needs permission to use the Trusted Computing Base (TCB), run the application as a configurable identity and assign the TCB permission to the configurable identity. This alternative, however, still presents a security risk because the TCB permission is very powerful.
For more information, see Configuring Worker Process Identities and IIS and Built-in Accounts in the Help that comes with IIS Manager.
Requests for Dynamic Content Return 404 Error
In order to take a more proactive stance against malicious users and attackers, IIS is installed in a highly secure and locked mode. By default, IIS serves only static content - meaning features like ASP, ASP.NET, server-side includes, WebDAV publishing, FrontPage ® Server Extensions, and Common Gateway Interfaces - do not work unless enabled. If you do not enable this functionality after installing IIS, by default on this denial, IIS returns a generic 404 custom error page to prevent disclosure of configuration information. IIS also writes the 404 error with the substatus code of 2 (404.2) in the W3C Extended log files, by default.
.gif) Important Note: |
|---|
You must be a member of the Administrators group on the local computer to perform the following procedure (or procedures), or you must have been delegated the appropriate authority. As a security best practice, log on to your computer using an account that is not in the Administrators group, and then use Runas to open a command window from which you can run other programs like IIS Manager. |
To open a command window under secure credentials, from a command prompt, type the following:
Runas /user:domain_or_machine_name\administrative_account_name "cmd /k"
To open IIS Manager from the secure command window, type the following:
mmc %systemroot%\system32\inetsrv\iis.msc
To enable or disable a Web service extension
In IIS Manager, expand the local computer, and then click Web Service Extensions.
In the details pane, click the Web service extension that you want to enable or disable.
To enable a disabled Web service extension, click Allow.
To disable an enabled Web service extension, click Prohibit.
Click OK.
To enable or disable Web service extensions programmatically, see WebSvcExtRestrictionList.
Requests for Static Files Return 404 Error
For requests to static content, this version of IIS serves requests for files with known file name extensions only, a feature called Known Extensions. If a request is made for a resource whose file name extension is not mapped to a known extension in the MimeMap property, IIS denies the request and logs a 404 error with the substatus code of 3 (404.3) in the W3C Extended log files (by default). To prevent disclosure of configuration information, IIS is configured to return the generic 404 custom error page by default on this denial. You can add or edit the Multipurpose Internet Mail Exchange (MIME) map using IIS Manager. To turn off the Known Extensions feature and allow IIS to serve files with any extension, add the *,application/octet-stream value to the list of MIME maps. If you update the global MIME map, you must wait until the worker process has recycled or restart the World Wide Web Publishing Service (WWW service) before changes take effect. If you update an individual Web site MIME map, the change is reflected instantly.
For more information on adding or editing the MIME map, see Working with MIME Types in the Help that comes with IIS Manager.
Tools like URLScan can be configured to block processing of certain file name extensions.
.gif) Note: |
|---|
Check your URLScan settings. |
Worker Process Recycling Drops Application Session State
By default, worker processes recycle after 120 minutes. If your ASP applications are not designed to store session state while a worker process is recycled, then session state in that ASP application can be lost. To remedy this problem, you can either store session state in a database or disable worker process recycling.
To disable worker process recycling
In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
On the Recycling tab, clear the Recycle worker processes (in minutes) check box.
Click OK.
Server-Side Include Directives (#include) Return 404 Error (for .stm Files) or 0131 Error (for .asp Files)
If your ASP page uses the #include server-side include directive and the ".." notation to refer to a parent directory, the directive will return an error unless you have reconfigured the AspEnableParentPaths metabase property. This property is set to false by default. If set to true, this property constitutes a potential security risk because an include path may access critical or sensitive data files outside the application root directory.
To enable parent paths through IIS Manager
In IIS Manager, expand the local computer, right-click the starting-point directory of the application you want to configure, and then click Properties.
Click the Directory tab, and then click Configuration.
Click the Options tab.
In the Application configuration section, select the Enable parent paths check box.
Click OK.
ASP Generates Permission Denied Errors in Event Log for Global.asa
Earlier versions of ASP executed events in the security context (or user identity) of the host process because there is no user context during these events. This caused problems, such as access denied errors when writing to a file in the Session_OnEnd event. ASP, by default, now runs the global.asa events, Application_OnEnd and Session_OnEnd, anonymously (the default value is true).
To change this setting programmatically, see AspRunOnEndAnonymously.
CGI Processes Will Not Start
If your CGI processes do not run, ensure that the CGI Web service extension has been enabled. See Requests for Dynamic Content Return 404 Error in this topic. Also, CGIs will not start unless the account on which the CGI processes run are assigned certain user rights. You can add the account as a member of the IIS_WPG group and assign the account the following two user rights:
To assign user rights to an account on the local computer
From the Start menu, point to Administrative Tools, and then click Local Security Policy.
Expand Security Settings, double-click Local Policies, and then double-click User Rights Assignment.
In the details pane, double-click the policy you want to change.
Click Add User or Group.
In the Enter the object names to select box, type the user or group name.
Click OK.
ASP.NET Pages are Returned as Static Files
If you installed IIS 6.0 without installing ASP.NET, ASP.NET files can be returned as static files. This error can also occur if you reinstalled IIS 6.0 without reregistering ASP.NET. To learn how to remedy this error, see ASP.NET IIS Registration Tool in the Help that comes with IIS Manager and use the i option.
Collaboration Data Objects for Windows NT Server Fail
Collaboration Data Objects for Microsoft ® Windows NT ® Server (CDONTS) has been removed from the Windows Server 2003 family. If your Web applications use CDONTS, you can convert them to Microsoft Collaboration Data Objects (CDO). Most methods in CDONTS have matching methods in CDO, but might be named differently.
For reference material for CDO in the Platform Software Developer Kit, see Overview of CDO at MSDN Online.