|
security
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
IIS6 'forgets' "Connect As" password for Virtual DirectoryI have a website that contains a virtual directory mapped to a UNC using a
domain account under "Connect As." Users are normally able to browse the virtual directory without incident. The site exist on an NLB cluster. Occasionally, one or two of the servers will forget the "Connect As" Password. The server will respond with a Server 500 error indicating that authentication failed. When I look at the "Connect As" box the password field will be blank, i.e. no ****** as is the normal condition. Has anyone else seen this? Is anyone able to use a virtual directory in an NLB cluster without this problem? Any help would be appriciated. Thanks, Richard M. Not me, have not seen one though.
Why don't you configure the 'connect as' user, close IIS MMC. restart the IIS service, reopen IIS MMC and then check if the configuration still there. -- Show quoteHide quoteRegards, Bernard Cheah http://www.iis-resources.com/ http://www.iiswebcastseries.com/ http://msmvps.com/blogs/bernard/ "Richard Manion" <Richard Man***@discussions.microsoft.com> wrote in message news:EAA004CB-4034-4FF4-86C4-837D59A7B2C8@microsoft.com... >I have a website that contains a virtual directory mapped to a UNC using a > domain account under "Connect As." Users are normally able to browse the > virtual directory without incident. The site exist on an NLB cluster. > Occasionally, one or two of the servers will forget the "Connect As" > Password. The server will respond with a Server 500 error indicating that > authentication failed. When I look at the "Connect As" box the password > field > will be blank, i.e. no ****** as is the normal condition. > > Has anyone else seen this? Is anyone able to use a virtual directory in an > NLB cluster without this problem? Any help would be appriciated. > > Thanks, > Richard M. IIS may be reset many times between when it drops the credentials. So when I
do that, the credentials seem to persist. Then, a while later, they will drop. Thanks or the suggestion, Richard Show quoteHide quote "Bernard Cheah [MVP]" wrote: > Not me, have not seen one though. > Why don't you configure the 'connect as' user, close IIS MMC. > restart the IIS service, reopen IIS MMC and then check if the configuration > still there. > > > -- > Regards, > Bernard Cheah > http://www.iis-resources.com/ > http://www.iiswebcastseries.com/ > http://msmvps.com/blogs/bernard/ > > > "Richard Manion" <Richard Man***@discussions.microsoft.com> wrote in message > news:EAA004CB-4034-4FF4-86C4-837D59A7B2C8@microsoft.com... > >I have a website that contains a virtual directory mapped to a UNC using a > > domain account under "Connect As." Users are normally able to browse the > > virtual directory without incident. The site exist on an NLB cluster. > > Occasionally, one or two of the servers will forget the "Connect As" > > Password. The server will respond with a Server 500 error indicating that > > authentication failed. When I look at the "Connect As" box the password > > field > > will be blank, i.e. no ****** as is the normal condition. > > > > Has anyone else seen this? Is anyone able to use a virtual directory in an > > NLB cluster without this problem? Any help would be appriciated. > > > > Thanks, > > Richard M. > > >
http://blogs.msdn.com/david.wang/archive/2005/04/27/IIS_Configuration_Mysteriously_Disappear.aspx
Usually when IIS configuration disappears, it is because: 1. Configuration change was cached in memory, not yet persisted to disk, and then someone triggers restart of IIS. Poof goes your changes. 2. Something else running on the server is "synchronizing" values incorrectly. IIS worker processes have no permission to change metabase values, WAS does not open the metabase, so all IIS6 metabase changes come from some sort of user-action. -- Show quoteHide quote//David IIS http://blogs.msdn.com/David.Wang This posting is provided "AS IS" with no warranties, and confers no rights. // "Richard Manion" <Richard Man***@discussions.microsoft.com> wrote in message news:EAA004CB-4034-4FF4-86C4-837D59A7B2C8@microsoft.com... >I have a website that contains a virtual directory mapped to a UNC using a > domain account under "Connect As." Users are normally able to browse the > virtual directory without incident. The site exist on an NLB cluster. > Occasionally, one or two of the servers will forget the "Connect As" > Password. The server will respond with a Server 500 error indicating that > authentication failed. When I look at the "Connect As" box the password > field > will be blank, i.e. no ****** as is the normal condition. > > Has anyone else seen this? Is anyone able to use a virtual directory in an > NLB cluster without this problem? Any help would be appriciated. > > Thanks, > Richard M. Believe it or not, I had searched your blog before posting and I read a
couple of articles on Syncronization. I hit the 'save to disk' button and got the 'no changes to save' response. I guess I will have to wait and see if it drops the credentials again. The biggest problem with debugging this is that we restart IIS a couple of times a week (in general) and the last time the password persisted for about a month before dropping, which makes this very hard to debug. Thanks for the help, I'll be back if it still happens, Richard Show quoteHide quote "David Wang [Msft]" wrote: > http://blogs.msdn.com/david.wang/archive/2005/04/27/IIS_Configuration_Mysteriously_Disappear.aspx > > Usually when IIS configuration disappears, it is because: > 1. Configuration change was cached in memory, not yet persisted to disk, and > then someone triggers restart of IIS. Poof goes your changes. > 2. Something else running on the server is "synchronizing" values > incorrectly. > > IIS worker processes have no permission to change metabase values, WAS does > not open the metabase, so all IIS6 metabase changes come from some sort of > user-action. > > -- > //David > IIS > http://blogs.msdn.com/David.Wang > This posting is provided "AS IS" with no warranties, and confers no rights. > // > > "Richard Manion" <Richard Man***@discussions.microsoft.com> wrote in message > news:EAA004CB-4034-4FF4-86C4-837D59A7B2C8@microsoft.com... > >I have a website that contains a virtual directory mapped to a UNC using a > > domain account under "Connect As." Users are normally able to browse the > > virtual directory without incident. The site exist on an NLB cluster. > > Occasionally, one or two of the servers will forget the "Connect As" > > Password. The server will respond with a Server 500 error indicating that > > authentication failed. When I look at the "Connect As" box the password > > field > > will be blank, i.e. no ****** as is the normal condition. > > > > Has anyone else seen this? Is anyone able to use a virtual directory in an > > NLB cluster without this problem? Any help would be appriciated. > > > > Thanks, > > Richard M. > > > This is IIS6 we are talking about. You shouldn't need to restart IIS a
couple times a week. Most people don't restart IIS6 for months at a time. Recycling Application Pool should be the most you need to do, if at all. For example, changing HTTP.SYS settings sometimes require a restart of IIS (because it requires restart of HTTP.SYS). But these tend to be global changes and makes sense to restart. Changing IIS settings are pretty much dynamic unless you are making global changes. And if you are making global changes that frequently, I have to ask "why". Thus, I think you should start by not restarting IIS a couple of times a week (in general) or at least identifying WHY you are restarting. No, "habit" does not count. http://blogs.msdn.com/david.wang/archive/2006/03/12/Thoughts_on_IIS_Configuration_Changes_and_when_it_takes_effect.aspx -- Show quoteHide quote//David IIS http://blogs.msdn.com/David.Wang This posting is provided "AS IS" with no warranties, and confers no rights. // "Richard Manion" <RichardMan***@discussions.microsoft.com> wrote in message news:BB89D1FE-FCDD-4F04-888A-E010DE6E4D8B@microsoft.com... > Believe it or not, I had searched your blog before posting and I read a > couple of articles on Syncronization. I hit the 'save to disk' button and > got > the 'no changes to save' response. I guess I will have to wait and see if > it > drops the credentials again. The biggest problem with debugging this is > that > we restart IIS a couple of times a week (in general) and the last time the > password persisted for about a month before dropping, which makes this > very > hard to debug. > > Thanks for the help, I'll be back if it still happens, > Richard > > "David Wang [Msft]" wrote: > >> http://blogs.msdn.com/david.wang/archive/2005/04/27/IIS_Configuration_Mysteriously_Disappear.aspx >> >> Usually when IIS configuration disappears, it is because: >> 1. Configuration change was cached in memory, not yet persisted to disk, >> and >> then someone triggers restart of IIS. Poof goes your changes. >> 2. Something else running on the server is "synchronizing" values >> incorrectly. >> >> IIS worker processes have no permission to change metabase values, WAS >> does >> not open the metabase, so all IIS6 metabase changes come from some sort >> of >> user-action. >> >> -- >> //David >> IIS >> http://blogs.msdn.com/David.Wang >> This posting is provided "AS IS" with no warranties, and confers no >> rights. >> // >> >> "Richard Manion" <Richard Man***@discussions.microsoft.com> wrote in >> message >> news:EAA004CB-4034-4FF4-86C4-837D59A7B2C8@microsoft.com... >> >I have a website that contains a virtual directory mapped to a UNC using >> >a >> > domain account under "Connect As." Users are normally able to browse >> > the >> > virtual directory without incident. The site exist on an NLB cluster. >> > Occasionally, one or two of the servers will forget the "Connect As" >> > Password. The server will respond with a Server 500 error indicating >> > that >> > authentication failed. When I look at the "Connect As" box the password >> > field >> > will be blank, i.e. no ****** as is the normal condition. >> > >> > Has anyone else seen this? Is anyone able to use a virtual directory in >> > an >> > NLB cluster without this problem? Any help would be appriciated. >> > >> > Thanks, >> > Richard M. >> >> >> So, it's been over a month, and this morning, 1 of the 6 nodes in our cluster
has 'forgotten' the "connect as" password. I now can also note that it forgot the password to two different resources, pointing at different servers. As to our repetitive reseting of IIS. We restart IIS when we make changes to the DLLs in our COM+/VB6 driven service tier. I expect that reseting the application pools would be sufficient for ensuring that IIS immediatly began using the new code, but it would be much more time consuming than reseting IIS. So, my question is, does resetting IIS risk some damage that we should be avoiding? If it is merely not necessary, but not harmful, reseting IIS is faster (since we have multiple application pools) and doesn't require me to change a process that has been in place for years. (An IIS reset was required in IIS 5.) Also, since the node will be stopped, resetting IIS has no consequence the end user. By the way, I know you hear it all the time, but I find your blog an invaluable resources for my day to day IIS management. Thanks, Richard Show quoteHide quote "David Wang [Msft]" wrote: > This is IIS6 we are talking about. You shouldn't need to restart IIS a > couple times a week. > > Most people don't restart IIS6 for months at a time. Recycling Application > Pool should be the most you need to do, if at all. > > For example, changing HTTP.SYS settings sometimes require a restart of IIS > (because it requires restart of HTTP.SYS). But these tend to be global > changes and makes sense to restart. > > Changing IIS settings are pretty much dynamic unless you are making global > changes. And if you are making global changes that frequently, I have to ask > "why". > > Thus, I think you should start by not restarting IIS a couple of times a > week (in general) or at least identifying WHY you are restarting. No, > "habit" does not count. > > http://blogs.msdn.com/david.wang/archive/2006/03/12/Thoughts_on_IIS_Configuration_Changes_and_when_it_takes_effect.aspx > > -- > //David > IIS > http://blogs.msdn.com/David.Wang > This posting is provided "AS IS" with no warranties, and confers no rights. > // > > "Richard Manion" <RichardMan***@discussions.microsoft.com> wrote in message > news:BB89D1FE-FCDD-4F04-888A-E010DE6E4D8B@microsoft.com... > > Believe it or not, I had searched your blog before posting and I read a > > couple of articles on Syncronization. I hit the 'save to disk' button and > > got > > the 'no changes to save' response. I guess I will have to wait and see if > > it > > drops the credentials again. The biggest problem with debugging this is > > that > > we restart IIS a couple of times a week (in general) and the last time the > > password persisted for about a month before dropping, which makes this > > very > > hard to debug. > > > > Thanks for the help, I'll be back if it still happens, > > Richard > > > > "David Wang [Msft]" wrote: > > > >> http://blogs.msdn.com/david.wang/archive/2005/04/27/IIS_Configuration_Mysteriously_Disappear.aspx > >> > >> Usually when IIS configuration disappears, it is because: > >> 1. Configuration change was cached in memory, not yet persisted to disk, > >> and > >> then someone triggers restart of IIS. Poof goes your changes. > >> 2. Something else running on the server is "synchronizing" values > >> incorrectly. > >> > >> IIS worker processes have no permission to change metabase values, WAS > >> does > >> not open the metabase, so all IIS6 metabase changes come from some sort > >> of > >> user-action. > >> > >> -- > >> //David > >> IIS > >> http://blogs.msdn.com/David.Wang > >> This posting is provided "AS IS" with no warranties, and confers no > >> rights. > >> // > >> > >> "Richard Manion" <Richard Man***@discussions.microsoft.com> wrote in > >> message > >> news:EAA004CB-4034-4FF4-86C4-837D59A7B2C8@microsoft.com... > >> >I have a website that contains a virtual directory mapped to a UNC using > >> >a > >> > domain account under "Connect As." Users are normally able to browse > >> > the > >> > virtual directory without incident. The site exist on an NLB cluster. > >> > Occasionally, one or two of the servers will forget the "Connect As" > >> > Password. The server will respond with a Server 500 error indicating > >> > that > >> > authentication failed. When I look at the "Connect As" box the password > >> > field > >> > will be blank, i.e. no ****** as is the normal condition. > >> > > >> > Has anyone else seen this? Is anyone able to use a virtual directory in > >> > an > >> > NLB cluster without this problem? Any help would be appriciated. > >> > > >> > Thanks, > >> > Richard M. > >> > >> > >> > > > 
Other interesting topics
HTTP_AUTHORIZATION header
Is there a way of downloading .cer files like you would do with .doc or .MP3 DMZ and Domains 403 (Forbidden) after setting up SSL Redirect Single authentication for multiple IIS 6 servers Cannot connect to Web Server from Different Domain Multiple SSL certs on virtual servers - again IIS Manager Closes Unexpectedly Can't audit security events Windows Authentication |
|||||||||||||||||||||||
