ASP.NET Permissions (I think)

[Pete]

Tearing my hair out with this one....

I've got a tiny ASP.NET site which works fine on my development machine.

I put the application onto a Test machine, and I get:

Cannot execute a program. The command being executed was
"c:\winnt\microsoft.net\framework\v1.0.3705\csc.exe" /noconfig

The first line of the trace is:

ExternalException (0x5): Cannot execute a program....

Now, I'm aware that Win32 error 5 = Access Denied.

To support this, the web server has the IIS Lockdown tool installed. I
de-installed this and the application ran successfully. However, it's
not really an option to leave this off permanently, so I need to get
both working together.

When I reapplied IIS Lockdown, the app stopped working again.

Now, the funnies:

1. The server happily runs other ASP and ASP.NET sites without any
permissions issues, lockdown or not. The other ASP site has exactly the
same config (essentially, High Isolation). Obviously different physical
file location.
2. When I load the pages in IE, neither RegMon nor FileMon show any
Access Denied errors. Or indeed, errors at all.
3. As far as I can see, the ASPNET worker process account has access to
both the source files and csc.exe (and the subfolders under the
framework directory)

Has anyone seen this problem before?
Can anyone think of what else I can do to chase this one down?

TIA,
Pete

 

[Jim Cheshire [MSFT]]

Pete,

Make sure that the ASPNET account is not a member of the "Web Anonymous
Users" and/or the "Web Applications" group. If it is, remove it.

Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.

--------------------

 

[Pete]

Jim,

ASPNET was a member of 2 groups, users and web applications.
I removed it from Web Applications. It makes no difference to the app
(still doesn't run).

Filemon still shows no access denied errors. However I have noticed
something funny on it. There are 4 frames on the site's front page, and
filemon shows the site's global.asax being accessed (read, successfully)
four times. No record of any access to any other file on the site, just
global.asax.

It's almost as if the site files themselves aren't being accessed,
except that (a) filemon should show this, and (b) default.htm, which
contains the frameset, is most definitely being loaded OK.

Presumably the ASP.NET dll will see that an aspx file has been
requested, then attempt to run it against csc? So if it can't run csc
that would explain why it never accesses the aspx file? I'm guessing
here but it seems reasonable.

Any more thoughts?

 

[Jim Cheshire [MSFT]]

Pete,

I agree that you should see that in Filemon. However, it's not surprising
that global.asax is getting hit. The Application_BeginRequest event will
fire on each request.

The most common cause of this problem is that the ASPNET account is a
member of one or more of these groups created by the IIS Lockdown tool,
both of which are explicitly denied access to many areas of the file
system. However, there are other reasons as well. See the following:

315904 BUG: "ExternalException: Cannot Execute a Program" Error Message When
http://support.microsoft.com/?id=315904

If none of that helps you, you should open a case with us and let us do
some additional troubleshooting.

Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.

--------------------