|
security
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
401.3 on IIS after SP1Any one had the problem that after installing SP1 that IIS presents the user
with a login window and if you cancel you get an 401.3 Unauthorized: Access is denied... Everything was working just fine until Windows Server 2003 SP1 was installed. Mmm.. SP1. look at the IIS log file, check if user has READ permission on
requested file. You can try filemon (sysinternals.com) to trace it as well. I have not seen 401.3 but many 401.1 with FPSE after sp1. -- Show quoteHide quoteRegards, Bernard Cheah http://www.microsoft.com/iis/ http://www.iiswebcastseries.com/ http://www.msmvps.com/bernard/ "M.Siler" <John.Doe@NoSpam.com> wrote in message news:ek1BjIGcFHA.3844@tk2msftngp13.phx.gbl... > Any one had the problem that after installing SP1 that IIS presents the > user with a login window and if you cancel you get an 401.3 Unauthorized: > Access is denied... > > Everything was working just fine until Windows Server 2003 SP1 was > installed. > I found these instruction on the Internet and followed them.
1. Open IIS Manager > Application Pools, then to the pool which is relevant to your site (in my case DefaultAppPool).. on this item, right click and choose properties. 2. Now navigate to the identity tab. 3. It was set to Predefined: Network Service. I changed this to Configurable: IWAM_(server name) I still get the windows login prompt, but it will authenticate me successfully. If I access the website from the server I am NOT presented with the login prompt. Why? What's the scoop with this change? Show quoteHide quote "Bernard Cheah [MVP]" <qbern***@hotmail.com.discuss> wrote in message news:%23HDg4UHcFHA.2520@TK2MSFTNGP09.phx.gbl... > Mmm.. SP1. look at the IIS log file, check if user has READ permission on > requested file. You can try filemon (sysinternals.com) to trace it as > well. > > I have not seen 401.3 but many 401.1 with FPSE after sp1. > > -- > Regards, > Bernard Cheah > http://www.microsoft.com/iis/ > http://www.iiswebcastseries.com/ > http://www.msmvps.com/bernard/ > > > "M.Siler" <John.Doe@NoSpam.com> wrote in message > news:ek1BjIGcFHA.3844@tk2msftngp13.phx.gbl... >> Any one had the problem that after installing SP1 that IIS presents the >> user with a login window and if you cancel you get an 401.3 Unauthorized: >> Access is denied... >> >> Everything was working just fine until Windows Server 2003 SP1 was >> installed. >> > > Cool ! but I'm not sure why. did you try revert back to network service,
then try filemon to trace ? if it's 401.3 then it's account permission issue. Take a look at David's reply as well. -- Show quoteHide quoteRegards, Bernard Cheah http://www.microsoft.com/iis/ http://www.iiswebcastseries.com/ http://www.msmvps.com/bernard/ "M.Siler" <email address not provided> wrote in message news:etICVtgcFHA.3712@TK2MSFTNGP12.phx.gbl... >I found these instruction on the Internet and followed them. > > 1. Open IIS Manager > Application Pools, then to the pool which is > relevant to your site (in my case DefaultAppPool).. on this item, right > click and choose properties. > > 2. Now navigate to the identity tab. > > 3. It was set to Predefined: Network Service. I changed this to > Configurable: IWAM_(server name) > > I still get the windows login prompt, but it will authenticate me > successfully. If I access the website from the server I am NOT presented > with the login prompt. > > Why? What's the scoop with this change? > > "Bernard Cheah [MVP]" <qbern***@hotmail.com.discuss> wrote in message > news:%23HDg4UHcFHA.2520@TK2MSFTNGP09.phx.gbl... >> Mmm.. SP1. look at the IIS log file, check if user has READ permission on >> requested file. You can try filemon (sysinternals.com) to trace it as >> well. >> >> I have not seen 401.3 but many 401.1 with FPSE after sp1. >> >> -- >> Regards, >> Bernard Cheah >> http://www.microsoft.com/iis/ >> http://www.iiswebcastseries.com/ >> http://www.msmvps.com/bernard/ >> >> >> "M.Siler" <John.Doe@NoSpam.com> wrote in message >> news:ek1BjIGcFHA.3844@tk2msftngp13.phx.gbl... >>> Any one had the problem that after installing SP1 that IIS presents the >>> user with a login window and if you cancel you get an 401.3 >>> Unauthorized: Access is denied... >>> >>> Everything was working just fine until Windows Server 2003 SP1 was >>> installed. >>> >> >> > > I tried going back to network service with no luck. I'll get filemon and see
what it shows. The link that David provided was for 401.1. That error I'm not getting, unless I turn off "Integrated Windows authentication". One more little twist in this mess is I'm running an Active/Passive cluster. Therefore, the user IWAM_NODEA is fine when NODEA is the active node, but when it fails over to NODEB... I'm wonding if I'm going to have a problem?? Show quoteHide quote "Bernard Cheah [MVP]" <qbern***@hotmail.com.discuss> wrote in message news:O$z$xVlcFHA.1404@TK2MSFTNGP09.phx.gbl... > Cool ! but I'm not sure why. did you try revert back to network service, > then try filemon to trace ? if it's 401.3 then it's account permission > issue. > > Take a look at David's reply as well. > > -- > Regards, > Bernard Cheah > http://www.microsoft.com/iis/ > http://www.iiswebcastseries.com/ > http://www.msmvps.com/bernard/ Actually, I think that 401.3 is a red-herring. Thus, I was asking you for
all the web log entries prior to the 401.3. At the same time, I was proposing a possible cause. -- //David IIS http://blogs.msdn.com/David.Wang This posting is provided "AS IS" with no warranties, and confers no rights. // "M.Siler" <John.Doe@NoSpam.com> wrote in message I tried going back to network service with no luck. I'll get filemon and seenews:uumpDKncFHA.2840@TK2MSFTNGP14.phx.gbl... what it shows. The link that David provided was for 401.1. That error I'm not getting, unless I turn off "Integrated Windows authentication". One more little twist in this mess is I'm running an Active/Passive cluster. Therefore, the user IWAM_NODEA is fine when NODEA is the active node, but when it fails over to NODEB... I'm wonding if I'm going to have a problem?? Show quoteHide quote "Bernard Cheah [MVP]" <qbern***@hotmail.com.discuss> wrote in message news:O$z$xVlcFHA.1404@TK2MSFTNGP09.phx.gbl... > Cool ! but I'm not sure why. did you try revert back to network service, > then try filemon to trace ? if it's 401.3 then it's account permission > issue. > > Take a look at David's reply as well. > > -- > Regards, > Bernard Cheah > http://www.microsoft.com/iis/ > http://www.iiswebcastseries.com/ > http://www.msmvps.com/bernard/ Yes, go ahead and try filemon. and check the log if you found any 401.1 like
what David has posted. As for the cluster setup, well normally we do IIS in NLB rather MSCS. anyway, the iwam account in node b will be used and if the configuration for both nodes is the same, I would guess you will not get any problem with it. -- Show quoteHide quoteRegards, Bernard Cheah http://www.microsoft.com/iis/ http://www.iiswebcastseries.com/ http://www.msmvps.com/bernard/ "David Wang [Msft]" <some***@online.microsoft.com> wrote in message news:O8BWW4tcFHA.2288@TK2MSFTNGP14.phx.gbl... > Actually, I think that 401.3 is a red-herring. Thus, I was asking you for > all the web log entries prior to the 401.3. At the same time, I was > proposing a possible cause. > > -- > //David > IIS > http://blogs.msdn.com/David.Wang > This posting is provided "AS IS" with no warranties, and confers no > rights. > // > "M.Siler" <John.Doe@NoSpam.com> wrote in message > news:uumpDKncFHA.2840@TK2MSFTNGP14.phx.gbl... > I tried going back to network service with no luck. I'll get filemon and > see > what it shows. The link that David provided was for 401.1. That error I'm > not getting, unless I turn off "Integrated Windows authentication". > > One more little twist in this mess is I'm running an Active/Passive > cluster. > Therefore, the user IWAM_NODEA is fine when NODEA is the active node, but > when it fails over to NODEB... I'm wonding if I'm going to have a > problem?? > > "Bernard Cheah [MVP]" <qbern***@hotmail.com.discuss> wrote in message > news:O$z$xVlcFHA.1404@TK2MSFTNGP09.phx.gbl... >> Cool ! but I'm not sure why. did you try revert back to network service, >> then try filemon to trace ? if it's 401.3 then it's account permission >> issue. >> >> Take a look at David's reply as well. >> >> -- >> Regards, >> Bernard Cheah >> http://www.microsoft.com/iis/ >> http://www.iiswebcastseries.com/ >> http://www.msmvps.com/bernard/ > > > Please post the web log entries for the requests PRIOR to the 401.3.
I suspect you are seeing: http://support.microsoft.com/?id=896861 -- //David IIS http://blogs.msdn.com/David.Wang This posting is provided "AS IS" with no warranties, and confers no rights. // "M.Siler" <John.Doe@NoSpam.com> wrote in message Any one had the problem that after installing SP1 that IIS presents the usernews:ek1BjIGcFHA.3844@tk2msftngp13.phx.gbl... with a login window and if you cancel you get an 401.3 Unauthorized: Access is denied... Everything was working just fine until Windows Server 2003 SP1 was installed. 
Other interesting topics
Problem w/ Integrated Auth -- Receiving User/Pass dialog box against IIS6
integrated vs basic ASP.NET app permissions Accessing Site as Anonymous Passing User Credentials to site running under Integrated Security Logging into website - remove log in box Server attack - info please? Can't get rid of localstart.asp Most secure solution for ftp (IIS?) Custom erorr messages |
|||||||||||||||||||||||
