IIS7 on Server 2008 Domain Controller

30 Oct 2008 10:38 AM

Steven Cools

hello,

i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
made it a DC.
then i wanted to install WSUS 3 on this new 2008 DC.
therefore i installed SQL 2005 and IIS 7.
i now have the -known- problem that the IUSR_ accounts are not registering
in AD.
the solution would be to run a .js script
(http://support.microsoft.com/kb/946139)

BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
following error:
"the directory property cannot be found in the cache" on line 52.

anyone any ideas?

cheers,
Steven.

31 Oct 2008 5:32 AM

David Wang

On Oct 30, 3:38 am, Steven Cools
<StevenCo***@discussions.microsoft.com> wrote:
Show quoteHide quote

> hello,
>
> i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> made it a DC.
> then i wanted to install WSUS 3 on this new 2008 DC.
> therefore i installed SQL 2005 and IIS 7.
> i now have the -known- problem that the IUSR_ accounts are not registering
> in AD.
> the solution would be to run a .js script
> (http://support.microsoft.com/kb/946139)
>
> BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> following error:
> "the directory property cannot be found in the cache" on line 52.
>
> anyone any ideas?
>
> cheers,
> Steven.

You should contact Microsoft PSS regarding support for the KB article.
That way, if there is a problem in the script, Microsoft knows to fix
it, and it helps everyone out, instead of just you if we resolve it
here.

For the most part, the problems are because you have older DCs and
thus constrain IIS7 to have the same problems installing on DCs as
prior versions. If/When you migrate forward, these issues go away.
IIS7 uses a built-in IUSR account to Windows Server 2008, which means
that all those issues with password expiration, accidentally denial of
anonymous auth user of IIS, user/ACL synchronization across multiple
machines, etc are no longer possible -- but with an old DC, all those
issues remain in addition to new issues mentioned in the KB.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

3 Nov 2008 1:11 PM

Steven Cools

since the script resulted in an error (and i thought it would've been well
tested by MS) i tried the following:

i transferred all the fsmo roles from the old 2K DC to the new 2K8 DC,
uninstalled SQL 2005, removed the IIS role and added it again after rebooting.
i now have the group IIS_IUSRS but it's empty (no IUSR_ account)
and when running the script i now get a different eror:
"domain is already operating in a mode higher than Windows Server 2003 mode.
Stopping script execution"

i checked my domain functional level and it is still "Windows 2000 native".

any ideas?

S.

PS: David, since the script is already from december 2007 i assume the
technet forums are a right place for questions/problems like these, no?

Show quoteHide quote

"David Wang" wrote:

> On Oct 30, 3:38 am, Steven Cools
> <StevenCo***@discussions.microsoft.com> wrote:
> > hello,
> >
> > i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> > made it a DC.
> > then i wanted to install WSUS 3 on this new 2008 DC.
> > therefore i installed SQL 2005 and IIS 7.
> > i now have the -known- problem that the IUSR_ accounts are not registering
> > in AD.
> > the solution would be to run a .js script
> > (http://support.microsoft.com/kb/946139)
> >
> > BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> > following error:
> > "the directory property cannot be found in the cache" on line 52.
> >
> > anyone any ideas?
> >
> > cheers,
> > Steven.
>
>
> You should contact Microsoft PSS regarding support for the KB article.
> That way, if there is a problem in the script, Microsoft knows to fix
> it, and it helps everyone out, instead of just you if we resolve it
> here.
>
> For the most part, the problems are because you have older DCs and
> thus constrain IIS7 to have the same problems installing on DCs as
> prior versions. If/When you migrate forward, these issues go away.
> IIS7 uses a built-in IUSR account to Windows Server 2008, which means
> that all those issues with password expiration, accidentally denial of
> anonymous auth user of IIS, user/ACL synchronization across multiple
> machines, etc are no longer possible -- but with an old DC, all those
> issues remain in addition to new issues mentioned in the KB.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //
>

3 Nov 2008 3:28 PM

Steven Cools

i transferred the fsmo roles to a 2K3 DC and ran the script and got dialog
boxes "running upgrade task" and "done!"

alas, no IUSR_ user accounts.

Show quoteHide quote

"Steven Cools" wrote:

> since the script resulted in an error (and i thought it would've been well
> tested by MS) i tried the following:
>
> i transferred all the fsmo roles from the old 2K DC to the new 2K8 DC,
> uninstalled SQL 2005, removed the IIS role and added it again after rebooting.
> i now have the group IIS_IUSRS but it's empty (no IUSR_ account)
> and when running the script i now get a different eror:
> "domain is already operating in a mode higher than Windows Server 2003 mode.
> Stopping script execution"
>
> i checked my domain functional level and it is still "Windows 2000 native".
>
> any ideas?
>
> S.
>
> PS: David, since the script is already from december 2007 i assume the
> technet forums are a right place for questions/problems like these, no?
>
> "David Wang" wrote:
>
> > On Oct 30, 3:38 am, Steven Cools
> > <StevenCo***@discussions.microsoft.com> wrote:
> > > hello,
> > >
> > > i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> > > made it a DC.
> > > then i wanted to install WSUS 3 on this new 2008 DC.
> > > therefore i installed SQL 2005 and IIS 7.
> > > i now have the -known- problem that the IUSR_ accounts are not registering
> > > in AD.
> > > the solution would be to run a .js script
> > > (http://support.microsoft.com/kb/946139)
> > >
> > > BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> > > following error:
> > > "the directory property cannot be found in the cache" on line 52.
> > >
> > > anyone any ideas?
> > >
> > > cheers,
> > > Steven.
> >
> >
> > You should contact Microsoft PSS regarding support for the KB article.
> > That way, if there is a problem in the script, Microsoft knows to fix
> > it, and it helps everyone out, instead of just you if we resolve it
> > here.
> >
> > For the most part, the problems are because you have older DCs and
> > thus constrain IIS7 to have the same problems installing on DCs as
> > prior versions. If/When you migrate forward, these issues go away.
> > IIS7 uses a built-in IUSR account to Windows Server 2008, which means
> > that all those issues with password expiration, accidentally denial of
> > anonymous auth user of IIS, user/ACL synchronization across multiple
> > machines, etc are no longer possible -- but with an old DC, all those
> > issues remain in addition to new issues mentioned in the KB.
> >
> >
> > //David
> > http://w3-4u.blogspot.com
> > http://blogs.msdn.com/David.Wang
> > //
> >

3 Nov 2008 9:19 PM

David Wang

Actually, scripts/binaries of KB articles are usually the least tested
code from Microsoft.

KB articles, associated hotfixes, and accompanying scripts tend to be
HIGHLY focused on getting a fix out FAST and CORRECT to the customer,
with comprehensive applicability being sacrificed. That's not to say
the work is quick and trashy -- there is effort to make sure it works
and is supportable, but it may not account for all possible situations
in the world.

Yes, one can discuss the script in Technet Forums, but that tends to
only help yourself and no one else. Without reporting failures to
Microsoft, you simply condemn other users to follow the same path as
you -- which ultimately means that you are actually misusing people's
time discussing the issue in a forum because it does not address the
root issue. Sure, it gets you fixed and on your way, but what about
the thousands following you? You may not care because it doesn't
affect you, but it affects those of us that answer questions. This is
why I recommend doing the right thing for yourself and others the
first time so that you get your situation resolved and it helps
everyone else out. It's a win-win for everyone, vs just a win for you
and lose for everyone else.

IIS7 no longer creates/uses any IUSR_user account for anonymous
access. It is using a built-in IUSR user of Windows Server 2008 by
default. This is why using an older DC condemns you to seeing no
improvements.

As for domain functional level -- the script detected Windows Server
2008 which clearly conflicts with what you are seeing. Yet another
reason to contact support to look at the script.

//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

On Nov 3, 5:11 am, Steven Cools
<StevenCo***@discussions.microsoft.com> wrote:
Show quoteHide quote

> since the script resulted in an error (and i thought it would've been well
> tested by MS) i tried the following:
>
> i transferred all the fsmo roles from the old 2K DC to the new 2K8 DC,
> uninstalled SQL 2005, removed the IIS role and added it again after rebooting.
> i now have the group IIS_IUSRS but it's empty (no IUSR_ account)
> and when running the script i now get a different eror:
> "domain is already operating in a mode higher than Windows Server 2003 mode.
> Stopping script execution"
>
> i checked my domain functional level and it is still "Windows 2000 native".
>
> any ideas?
>
> S.
>
> PS: David, since the script is already from december 2007 i assume the
> technet forums are a right place for questions/problems like these, no?
>
>
>
> "David Wang" wrote:
> > On Oct 30, 3:38 am, Steven Cools
> > <StevenCo***@discussions.microsoft.com> wrote:
> > > hello,
>
> > > i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> > > made it a DC.
> > > then i wanted to install WSUS 3 on this new 2008 DC.
> > > therefore i installed SQL 2005 and IIS 7.
> > > i now have the -known- problem that the IUSR_ accounts are not registering
> > > in AD.
> > > the solution would be to run a .js script
> > > (http://support.microsoft.com/kb/946139)
>
> > > BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> > > following error:
> > > "the directory property cannot be found in the cache" on line 52.
>
> > > anyone any ideas?
>
> > > cheers,
> > > Steven.
>
> > You should contact Microsoft PSS regarding support for the KB article.
> > That way, if there is a problem in the script, Microsoft knows to fix
> > it, and it helps everyone out, instead of just you if we resolve it
> > here.
>
> > For the most part, the problems are because you have older DCs and
> > thus constrain IIS7 to have the same problems installing on DCs as
> > prior versions. If/When you migrate forward, these issues go away.
> > IIS7 uses a built-in IUSR account to Windows Server 2008, which means
> > that all those issues with password expiration, accidentally denial of
> > anonymous auth user of IIS, user/ACL synchronization across multiple
> > machines, etc are no longer possible -- but with an old DC, all those
> > issues remain in addition to new issues mentioned in the KB.
>
> > //David
> >http://w3-4u.blogspot.com
> >http://blogs.msdn.com/David.Wang
> > //- Hide quoted text -
>
> - Show quoted text -

13 Jan 2009 1:58 PM

AlexH

You are not alone - I have the identical result and problem. Reinstalling the
Web Services role has no effect either.

12 Feb 2009 6:19 PM

Clifford Gindulis

I can't recommend doing this but I did find a way to work around it.

What worked for me, but may completely corrupt your server, was to REM out
the pdc functionality level check.

Here is how it looks now:

// Check whether the PDC is a legacy domain or not.
// var domainControllerFunctionality =
pdcRootDse.Get("domainControllerFunctionality");

//if ( domainControllerFunctionality > 2 )
//{
// WScript.Echo("Domain is already operating in a mode higher than
Windows Server 2003 mode. Stopping script execution.");
// WScript.Quit(0);
//}

I suspect this problem is related to the DNS root partition error that I
had. That was fixed by moving the Operations Master role off of the 2000 ADC
and onto the new 2008 ADC.

Anyway, changing the script got it for me...but I was in a position where I
could gamble the server build. You will want to think twice before trying it
on a production machine.

Show quoteHide quote

"Steven Cools" wrote:

> hello,
>
> i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> made it a DC.
> then i wanted to install WSUS 3 on this new 2008 DC.
> therefore i installed SQL 2005 and IIS 7.
> i now have the -known- problem that the IUSR_ accounts are not registering
> in AD.
> the solution would be to run a .js script
> (http://support.microsoft.com/kb/946139)
>
> BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> following error:
> "the directory property cannot be found in the cache" on line 52.
>
> anyone any ideas?
>
> cheers,
> Steven.

12 Feb 2009 6:24 PM

Clifford Gindulis

Sigh, I don't know what happened. This line is also supposed to be REMd

//pdcRootDse.Get("domainControllerFunctionality");

Show quoteHide quote

"Clifford Gindulis" wrote:

> I can't recommend doing this but I did find a way to work around it.
>
> What worked for me, but may completely corrupt your server, was to REM out
> the pdc functionality level check.
>
> Here is how it looks now:
>
> // Check whether the PDC is a legacy domain or not.
> // var domainControllerFunctionality =
> pdcRootDse.Get("domainControllerFunctionality");
>
> //if ( domainControllerFunctionality > 2 )
> //{
> // WScript.Echo("Domain is already operating in a mode higher than
> Windows Server 2003 mode. Stopping script execution.");
> // WScript.Quit(0);
> //}
>
> I suspect this problem is related to the DNS root partition error that I
> had. That was fixed by moving the Operations Master role off of the 2000 ADC
> and onto the new 2008 ADC.
>
> Anyway, changing the script got it for me...but I was in a position where I
> could gamble the server build. You will want to think twice before trying it
> on a production machine.
>
>
> "Steven Cools" wrote:
>
> > hello,
> >
> > i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> > made it a DC.
> > then i wanted to install WSUS 3 on this new 2008 DC.
> > therefore i installed SQL 2005 and IIS 7.
> > i now have the -known- problem that the IUSR_ accounts are not registering
> > in AD.
> > the solution would be to run a .js script
> > (http://support.microsoft.com/kb/946139)
> >
> > BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> > following error:
> > "the directory property cannot be found in the cache" on line 52.
> >
> > anyone any ideas?
> >
> > cheers,
> > Steven.

12 Feb 2009 6:21 PM

Clifford Gindulis

I was able to work around this by REM'ng out all of the lines related to the
domain functionality level. It's not an optimal solution so consider
carefully before doing it. I went for it because I could afford to lose the
server build, if your machine is already in production you will want to be
careful.

Show quoteHide quote

"Steven Cools" wrote:

> hello,
>
> i added a new 2008 server to my 2000 domain (with 2000 and 2003 DC's) and
> made it a DC.
> then i wanted to install WSUS 3 on this new 2008 DC.
> therefore i installed SQL 2005 and IIS 7.
> i now have the -known- problem that the IUSR_ accounts are not registering
> in AD.
> the solution would be to run a .js script
> (http://support.microsoft.com/kb/946139)
>
> BUT, when running this script (SamUpgradeTask.js) on my 2008 DC i get the
> following error:
> "the directory property cannot be found in the cache" on line 52.
>
> anyone any ideas?
>
> cheers,
> Steven.