ASP Developer Network - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com

ASPDeveloper

ASPDeveloper.Net / VirtualServerFAQ.COM

Make sure you go to our home page for:

* Virtual Server 2005 FAQ
* ASP.Net 2.0 Information
* ASP.Net 2.0 Streaming Tutorials
* ASP.Net 2.0 HTML based Tutorials

Made possible by Business Internet Technology Shop (BitShop)

Virtual Server 2005

Recent Virtual Server 2005 posts

* NIC Question
* Physical Network Adapter not available
* Differencing disk problems in Virtual Server R2
* How to backup/restore the virtual machine for Virtual Server 2003
* IPv6
* crash on VS R2 SP1 64 bits
* Urgent:Help! Getting Error When trying to connect to the VMRC Client
* Virtual Server 2005 R2 - Automatic start of VM
* VM Additions for Linux
* Jumbo Frame Support
* Virtual Machines - COM Port Validation Problems
* I can add a cpu o cpus in a virtual machine in virtual server?
* Completely deleting VMs from host
* Windows Virtual Server 2005 VMRC Display Problem
* virtual CD drive
* Nvidia nforce network controller and vs2005 R2
* Host Operating System Network Connectivity Problem
* Broadcom Host and Guest Network Disconnect
* Good Books yet on Virtual Server 2005 R2?
* How to test if the backup is valid?

Add Solution

web administration

Source: microsoft.public.virtualserver
Sent: 10/25/2006
From: "Caius Bonus" <caiusATbonusland.com>
Message:

Hi,

Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch the
browser and add a user in security panel.

But impossible for that user to browse the web administration from any
computer. Page is ERROR 403 Access DENIED.

When i put this user in the default local administrators group, access is
ok.

What's wrong ?

Regards.

Post Reply | This is Spam! | Mark as Spam

Related Messages

Re: web administration

Sent: 10/25/2006
From: "Ronnie Isherwood" <(email address - cut out)>
Message:

Hi,

there is a support article here: http://support.microsoft.com/kb/891609

and some basic reading on Virtual Server Security here:
http://www.microsoft.com/technet/prodtechnol/virtualserver/2005/proddocs/vs_deploy_secure_vs.mspx?mfr=true

Hope this helps

Ronnie

"Caius Bonus" <caiusATbonusland.com> wrote in message
news:(email address - cut out)...

Show quoted text

> Hi,
>
> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch the
> browser and add a user in security panel.
>
> But impossible for that user to browse the web administration from any
> computer. Page is ERROR 403 Access DENIED.
>
> When i put this user in the default local administrators group, access is
> ok.
>
> What's wrong ?
>
> Regards.
>

Re: web administration

Sent: 10/26/2006
From: "Caius Bonus" <caiusATbonusland.com>
Message:

Hi,

Thanks, SP1 was included in W2K3 when i installed it.
I ckecked the KB and all seems ok.

but, don't works.

Something else : when i put the full name in url i got instantly the 403
page but when i put IP i got auth window for credits...

PS: ive activated SSL (works ok).

"Ronnie Isherwood" <(email address - cut out)> a écrit dans le message de
news: (email address - cut out)...

Show quoted text

> Hi,
>
> there is a support article here: http://support.microsoft.com/kb/891609
>
> and some basic reading on Virtual Server Security here:
> http://www.microsoft.com/technet/prodtechnol/virtualserver/2005/proddocs/vs_deploy_secure_vs.mspx?mfr=true
>
> Hope this helps
>
> Ronnie
>
>
> "Caius Bonus" <caiusATbonusland.com> wrote in message
> news:(email address - cut out)...
>> Hi,
>>
>> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch
>> the browser and add a user in security panel.
>>
>> But impossible for that user to browse the web administration from any
>> computer. Page is ERROR 403 Access DENIED.
>>
>> When i put this user in the default local administrators group, access is
>> ok.
>>
>> What's wrong ?
>>
>> Regards.
>>
>
>

Re: web administration

Sent: 10/26/2006
From: "Ronnie Isherwood" <(email address - cut out)>
Message:

Hi some questions to understand whats preventing access to the site:

Is your user local to the host server or is it domain user?

If you access the server by IP and enter credentials do you get into the web
admin page?

How is the client PC resolving the website name? DNS, Host file, broadcast?

Are there any other elements between the client pc and the website? i.e. is
there a proxy server the url request traverses?

Is the host running any other services like DC?

If you haven't already I would check the event logs on the server for any
errors.

You can perform a quick test to see if this is a virtual server / web issue
or general IIS auth issue by creating another ssl website on the host server
and ensure you can get to it by name.

Regards

Ronnie

"Caius Bonus" <caiusATbonusland.com> wrote in message
news:(email address - cut out)...

Show quoted text

> Hi,
>
> Thanks, SP1 was included in W2K3 when i installed it.
> I ckecked the KB and all seems ok.
>
> but, don't works.
>
> Something else : when i put the full name in url i got instantly the 403
> page but when i put IP i got auth window for credits...
>
> PS: ive activated SSL (works ok).
>
>
>
>
>
> "Ronnie Isherwood" <(email address - cut out)> a écrit dans le message
> de news: (email address - cut out)...
>> Hi,
>>
>> there is a support article here: http://support.microsoft.com/kb/891609
>>
>> and some basic reading on Virtual Server Security here:
>> http://www.microsoft.com/technet/prodtechnol/virtualserver/2005/proddocs/vs_deploy_secure_vs.mspx?mfr=true
>>
>> Hope this helps
>>
>> Ronnie
>>
>>
>> "Caius Bonus" <caiusATbonusland.com> wrote in message
>> news:(email address - cut out)...
>>> Hi,
>>>
>>> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch
>>> the browser and add a user in security panel.
>>>
>>> But impossible for that user to browse the web administration from any
>>> computer. Page is ERROR 403 Access DENIED.
>>>
>>> When i put this user in the default local administrators group, access
>>> is ok.
>>>
>>> What's wrong ?
>>>
>>> Regards.
>>>
>>
>>
>
>

Re: web administration

Sent: 10/27/2006
From: "David Wang" <(email address - cut out)>
Message:

Non-admin cannot administer VS2005 by default. You need to make
additional configuration to allow non-admin to administer VS2005.

http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-2005-Administration-on-IIS.aspx

If you believe that everything is properly configured, then can you
please provide the IIS log entry for the request that returned the 403
so that we can troubleshoot your configuration.

It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is the
ID of the Virtual Server Admin website.

In particular, I want the HTTP sub-status code of the 403 because it
will directly tell you what is wrong and how to fix it.

//David
http://w3-4u.blogspot.com
//

Caius Bonus wrote:

Show quoted text

Re: web administration

Sent: 10/27/2006
From: "David Wang" <(email address - cut out)>
Message:

You have to use the administrator to login to VS2005 admin website to
be able to add non-admin user to VS Security property page so that
non-admin user can administer VS.

This is no different than if you want to allow non-admin users to be
able to Remote Desktop into the server - you first use the
administrator to add a non-admin user to the Remote Desktop Users group
and then you can Remote Desktop to this server with that non-admin
user.

403 19 with error 1314 usually happens when you launch a CGI (such as
VS2005 admin CGI EXE) with an Application Pool Identity that does not
have several necessary privileges. This usually happens if you used a
custom Application Pool Identity in IIS, or your domain has a group
policy which removed those privileges from the IIS Application Pool
Identity.

I suspect your domain group policy is accidentally locked down to
prevent VS2005 from working with a user like toto. Seen it many times
before.

//David
http://w3-4u.blogspot.com
//

Caius Bonus wrote:
;+.NET+CLR+2.0.50727)
;+.NET+CLR+2.0.50727)
oto
;+.NET+CLR+2.0.50727)
;+.NET+CLR+2.0.50727)
te
;+.NET+CLR+2.0.50727)
;+.NET+CLR+2.0.50727)
oto
;+.NET+CLR+2.0.50727)
;+.NET+CLR+2.0.50727)
or
-Administration-on-IIS.aspx
is

Show quoted text

> Hi,
>
> First test, from my client i set https://srv/ , no certificate popup and
> access denied see log :
>
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 401 2 2148074254
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 401 1 0
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /Default.htm - 443 MyDOMAIN\t=
> 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 200 0 0
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> view=3D1 443 MyDOMAIN\toto 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 403 19 1314
>
> Second test, i set https://192.168.0.14, i got and validate the certifica=
> popup but always access denied :
>
> 2006-10-27 09:01:54 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 401 2 2148074254
> 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 401 1 0
> 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /Default.htm - 443 MyDOMAIN\t=
> 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 200 0 0
> 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> view=3D1 443 MyDOMAIN\toto 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322=
> 403 19 1314
>
> I check the link but im sorry i don't find the HOWTO set non administrator
> to display VS web administration.
>
> When i inserted my user toto in the web admin security panel i got no err=
> and the domain was automatically added.
> I checked DCOM options but all seems right.
>
> Hope this help !
>
>
> "David Wang" <(email address - cut out)> a =E9crit dans le message de news:
> (email address - cut out)...
> > Non-admin cannot administer VS2005 by default. You need to make
> > additional configuration to allow non-admin to administer VS2005.
> >
> > http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-2005=
> >
> > If you believe that everything is properly configured, then can you
> > please provide the IIS log entry for the request that returned the 403
> > so that we can troubleshoot your configuration.
> >
> > It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is the
> > ID of the Virtual Server Admin website.
> >
> > In particular, I want the HTTP sub-status code of the 403 because it
> > will directly tell you what is wrong and how to fix it.
> >
> >
> >
> > //David
> > http://w3-4u.blogspot.com
> > //
> >
> >
> > Caius Bonus wrote:
> >> Hi,
> >>
> >> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch
> >> the
> >> browser and add a user in security panel.
> >>
> >> But impossible for that user to browse the web administration from any
> >> computer. Page is ERROR 403 Access DENIED.
> >>
> >> When i put this user in the default local administrators group, access=
> >> ok.
> >>
> >> What's wrong ?
> >>
> >> Regards.
> >

Re: web administration

Sent: 10/27/2006
From: "David Wang" <(email address - cut out)>
Message:

It depends on where you are getting denied access.

If the user "toto" is getting the 403.19 Forbidden error, then that
happens before any of your VS Security settings take place -- so you
need to first fix that issue at the IIS admin website level first.

After that is taken care of, then VS Security settings apply when the
user tries to manipulate Virtual Machines.

VS Security has nothing to do with Group Policy. IIS Security also has
nothing to do with Group Policy. You just look at the error codes and
diagnose them in the right sequence of importance.

//David
http://w3-4u.blogspot.com
//

Caius Bonus wrote:
y=2E
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
22;+.NET+CLR+2.0.50727)
tor
05-Administration-on-IIS.aspx
ch
ny
ss

Show quoted text

> Re,
>
> "You have to use the administrator to login to VS2005 admin website to
> be able to add non-admin user to VS Security property page so that
> non-admin user can administer VS."
>
> That's exactly i do just after installing VS. I log Administrator then
> i setup some features and add this user for test administration.
>
> I do a Rsop on my host to see what parameters are modified by group polic=
> I don't see something special.
>
> Where i must search/parameter change to allow toto ?
>
>
> Regards.
>
>
> "David Wang" <(email address - cut out)> a =E9crit dans le message de news:
> (email address - cut out)...
> You have to use the administrator to login to VS2005 admin website to
> be able to add non-admin user to VS Security property page so that
> non-admin user can administer VS.
>
> This is no different than if you want to allow non-admin users to be
> able to Remote Desktop into the server - you first use the
> administrator to add a non-admin user to the Remote Desktop Users group
> and then you can Remote Desktop to this server with that non-admin
> user.
>
> 403 19 with error 1314 usually happens when you launch a CGI (such as
> VS2005 admin CGI EXE) with an Application Pool Identity that does not
> have several necessary privileges. This usually happens if you used a
> custom Application Pool Identity in IIS, or your domain has a group
> policy which removed those privileges from the IIS Application Pool
> Identity.
>
> I suspect your domain group policy is accidentally locked down to
> prevent VS2005 from working with a user like toto. Seen it many times
> before.
>
>
> //David
> http://w3-4u.blogspot.com
> //
>
>
> Caius Bonus wrote:
> > Hi,
> >
> > First test, from my client i set https://srv/ , no certificate popup and
> > access denied see log :
> >
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 401 2 2148074254
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 401 1 0
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /Default.htm - 443
> > MyDOMAIN\toto
> > 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 200 0 0
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> > view=3D1 443 MyDOMAIN\toto 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 403 19 1314
> >
> > Second test, i set https://192.168.0.14, i got and validate the
> > certificate
> > popup but always access denied :
> >
> > 2006-10-27 09:01:54 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 401 2 2148074254
> > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 401 1 0
> > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /Default.htm - 443
> > MyDOMAIN\toto
> > 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 200 0 0
> > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> > view=3D1 443 MyDOMAIN\toto 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.43=
> > 403 19 1314
> >
> > I check the link but im sorry i don't find the HOWTO set non administra=
> > to display VS web administration.
> >
> > When i inserted my user toto in the web admin security panel i got no
> > error
> > and the domain was automatically added.
> > I checked DCOM options but all seems right.
> >
> > Hope this help !
> >
> >
> > "David Wang" <(email address - cut out)> a =E9crit dans le message de news:
> > (email address - cut out)...
> > > Non-admin cannot administer VS2005 by default. You need to make
> > > additional configuration to allow non-admin to administer VS2005.
> > >
> > > http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-20=
> > >
> > > If you believe that everything is properly configured, then can you
> > > please provide the IIS log entry for the request that returned the 403
> > > so that we can troubleshoot your configuration.
> > >
> > > It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is the
> > > ID of the Virtual Server Admin website.
> > >
> > > In particular, I want the HTTP sub-status code of the 403 because it
> > > will directly tell you what is wrong and how to fix it.
> > >
> > >
> > >
> > > //David
> > > http://w3-4u.blogspot.com
> > > //
> > >
> > >
> > > Caius Bonus wrote:
> > >> Hi,
> > >>
> > >> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can laun=
> > >> the
> > >> browser and add a user in security panel.
> > >>
> > >> But impossible for that user to browse the web administration from a=
> > >> computer. Page is ERROR 403 Access DENIED.
> > >>
> > >> When i put this user in the default local administrators group, acce=
> > >> is
> > >> ok.
> > >>
> > >> What's wrong ?
> > >>
> > >> Regards.
> > >

Re: web administration

Sent: 10/27/2006
From: "Caius Bonus" <caiusATbonusland.com>
Message:

Hi,

First test, from my client i set https://srv/ , no certificate popup and
access denied see log :

2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
401 2 2148074254
2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
401 1 0
2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /Default.htm - 443 MyDOMAIN\toto
192.168.1.2
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
200 0 0
2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
view=1 443 MyDOMAIN\toto 192.168.1.2
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
403 19 1314

Second test, i set https://192.168.0.14, i got and validate the certificate
popup but always access denied :

2006-10-27 09:01:54 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
401 2 2148074254
2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
401 1 0
2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /Default.htm - 443 MyDOMAIN\toto
192.168.1.2
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
200 0 0
2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
view=1 443 MyDOMAIN\toto 192.168.1.2
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
403 19 1314

I check the link but im sorry i don't find the HOWTO set non administrator
to display VS web administration.

When i inserted my user toto in the web admin security panel i got no error
and the domain was automatically added.
I checked DCOM options but all seems right.

Hope this help !

"David Wang" <(email address - cut out)> a écrit dans le message de news:
(email address - cut out)...

Show quoted text

> Non-admin cannot administer VS2005 by default. You need to make
> additional configuration to allow non-admin to administer VS2005.
>
> http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-2005-Administration-on-IIS.aspx
>
> If you believe that everything is properly configured, then can you
> please provide the IIS log entry for the request that returned the 403
> so that we can troubleshoot your configuration.
>
> It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is the
> ID of the Virtual Server Admin website.
>
> In particular, I want the HTTP sub-status code of the 403 because it
> will directly tell you what is wrong and how to fix it.
>
>
>
> //David
> http://w3-4u.blogspot.com
> //
>
>
> Caius Bonus wrote:
>> Hi,
>>
>> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch
>> the
>> browser and add a user in security panel.
>>
>> But impossible for that user to browse the web administration from any
>> computer. Page is ERROR 403 Access DENIED.
>>
>> When i put this user in the default local administrators group, access is
>> ok.
>>
>> What's wrong ?
>>
>> Regards.
>

Re: web administration

Sent: 10/27/2006
From: "Caius Bonus" <caiusATbonusland.com>
Message:

Hi,

"Ronnie Isherwood" <(email address - cut out)> a écrit dans le message de
news: (email address - cut out)...

DOMAIN user

No, same error 403 Access DENIED.

DNS, we have 2 dns servers

No, all ports are opens on LAN, nota my client computer is on another subnet
than the server.

No, only VS 2005 RC2.

No errors in event logs.

Simply if i reach the host with IP, i get the ssl popup then credentials
window.
I can see web admin page if i use an account that is member of local
administrator account.

Hope this help Thanks.

Show quoted text

> Hi some questions to understand whats preventing access to the site:
>
> Is your user local to the host server or is it domain user?
>
> If you access the server by IP and enter credentials do you get into the
> web admin page?
>
> How is the client PC resolving the website name? DNS, Host file,
> broadcast?
>
> Are there any other elements between the client pc and the website? i.e.
> is there a proxy server the url request traverses?
>
> Is the host running any other services like DC?
>
> If you haven't already I would check the event logs on the server for any
> errors.
>
> You can perform a quick test to see if this is a virtual server / web
> issue or general IIS auth issue by creating another ssl website on the
> host server and ensure you can get to it by name.
>
> Regards
>
> Ronnie

Re: web administration [SOLVED]

Sent: 10/27/2006
From: "David Wang" <(email address - cut out)>
Message:

Yes, those are the two privileges necessary to allow IIS to launch CGIs
(such as VS2005's web admin CGI) to allow end-users access.

//David
http://w3-4u.blogspot.com
//

Caius Bonus wrote:
and
4322;+.NET+CLR+2.0.50727)
4322;+.NET+CLR+2.0.50727)
4322;+.NET+CLR+2.0.50727)
xe
4322;+.NET+CLR+2.0.50727)
4322;+.NET+CLR+2.0.50727)
4322;+.NET+CLR+2.0.50727)
4322;+.NET+CLR+2.0.50727)
xe
4322;+.NET+CLR+2.0.50727)
2005-Administration-on-IIS.aspx
403
he

Show quoted text

> Hi,
>
> I ve solved the problem, i create an OU under my Servers OU in which i
> placed my host.
> I apply on it a group policy modifying 2 parameters :
>
> Under "User Rights Assignment", find "Replace a process-level token" and
> "Adjust memory Quotas for a Process" and add your user to both.
>
> After a reboot of my host, i could access web admin from toto !
>
> I need now to test some group/delegation VM with VS, but all seems ok.
>
> Thanks for all.
>
>
>
> "David Wang" <(email address - cut out)> a =E9crit dans le message de news:
> (email address - cut out)...
> It depends on where you are getting denied access.
>
> If the user "toto" is getting the 403.19 Forbidden error, then that
> happens before any of your VS Security settings take place -- so you
> need to first fix that issue at the IIS admin website level first.
>
> After that is taken care of, then VS Security settings apply when the
> user tries to manipulate Virtual Machines.
>
> VS Security has nothing to do with Group Policy. IIS Security also has
> nothing to do with Group Policy. You just look at the error codes and
> diagnose them in the right sequence of importance.
>
>
> //David
> http://w3-4u.blogspot.com
> //
>
>
>
> Caius Bonus wrote:
> > Re,
> >
> > "You have to use the administrator to login to VS2005 admin website to
> > be able to add non-admin user to VS Security property page so that
> > non-admin user can administer VS."
> >
> > That's exactly i do just after installing VS. I log Administrator then
> > i setup some features and add this user for test administration.
> >
> > I do a Rsop on my host to see what parameters are modified by group
> > policy.
> > I don't see something special.
> >
> > Where i must search/parameter change to allow toto ?
> >
> >
> > Regards.
> >
> >
> > "David Wang" <(email address - cut out)> a =E9crit dans le message de news:
> > (email address - cut out)...
> > You have to use the administrator to login to VS2005 admin website to
> > be able to add non-admin user to VS Security property page so that
> > non-admin user can administer VS.
> >
> > This is no different than if you want to allow non-admin users to be
> > able to Remote Desktop into the server - you first use the
> > administrator to add a non-admin user to the Remote Desktop Users group
> > and then you can Remote Desktop to this server with that non-admin
> > user.
> >
> > 403 19 with error 1314 usually happens when you launch a CGI (such as
> > VS2005 admin CGI EXE) with an Application Pool Identity that does not
> > have several necessary privileges. This usually happens if you used a
> > custom Application Pool Identity in IIS, or your domain has a group
> > policy which removed those privileges from the IIS Application Pool
> > Identity.
> >
> > I suspect your domain group policy is accidentally locked down to
> > prevent VS2005 from working with a user like toto. Seen it many times
> > before.
> >
> >
> > //David
> > http://w3-4u.blogspot.com
> > //
> >
> >
> > Caius Bonus wrote:
> > > Hi,
> > >
> > > First test, from my client i set https://srv/ , no certificate popup =
> > > access denied see log :
> > >
> > > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 401 2 2148074254
> > > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 401 1 0
> > > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /Default.htm - 443
> > > MyDOMAIN\toto
> > > 192.168.1.2
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 200 0 0
> > > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.e=
> > > view=3D1 443 MyDOMAIN\toto 192.168.1.2
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 403 19 1314
> > >
> > > Second test, i set https://192.168.0.14, i got and validate the
> > > certificate
> > > popup but always access denied :
> > >
> > > 2006-10-27 09:01:54 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 401 2 2148074254
> > > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 401 1 0
> > > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /Default.htm - 443
> > > MyDOMAIN\toto
> > > 192.168.1.2
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 200 0 0
> > > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.e=
> > > view=3D1 443 MyDOMAIN\toto 192.168.1.2
> > > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.=
> > > 403 19 1314
> > >
> > > I check the link but im sorry i don't find the HOWTO set non
> > > administrator
> > > to display VS web administration.
> > >
> > > When i inserted my user toto in the web admin security panel i got no
> > > error
> > > and the domain was automatically added.
> > > I checked DCOM options but all seems right.
> > >
> > > Hope this help !
> > >
> > >
> > > "David Wang" <(email address - cut out)> a =E9crit dans le message de news:
> > > (email address - cut out)...
> > > > Non-admin cannot administer VS2005 by default. You need to make
> > > > additional configuration to allow non-admin to administer VS2005.
> > > >
> > > > http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-=
> > > >
> > > > If you believe that everything is properly configured, then can you
> > > > please provide the IIS log entry for the request that returned the =
> > > > so that we can troubleshoot your configuration.
> > > >
> > > > It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is t=
> > > > ID of the Virtual Server Admin website.
> > > >
> > > > In particular, I want the HTTP sub-status code of the 403 because it
> > > > will directly tell you what is wrong and how to fix it.
> > > >
> > > >
> > > >
> > > > //David
> > > > http://w3-4u.blogspot.com
> > > > //
> > > >
> > > >
> > > > Caius Bonus wrote:
> > > >> Hi,
> > > >>
> > > >> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can
> > > >> launch
> > > >> the
> > > >> browser and add a user in security panel.
> > > >>
> > > >> But impossible for that user to browse the web administration from
> > > >> any
> > > >> computer. Page is ERROR 403 Access DENIED.
> > > >>
> > > >> When i put this user in the default local administrators group,
> > > >> access
> > > >> is
> > > >> ok.
> > > >>
> > > >> What's wrong ?
> > > >>
> > > >> Regards.
> > > >

Re: web administration [SOLVED]

Sent: 10/27/2006
From: "David Wang" <(email address - cut out)>
Message:

Show quoted text

Re: web administration [SOLVED]

Sent: 10/27/2006
From: "David Wang" <(email address - cut out)>
Message:

Show quoted text

Re: web administration

Sent: 10/27/2006
From: "Caius Bonus" <caiusATbonusland.com>
Message:

Re,

"You have to use the administrator to login to VS2005 admin website to
be able to add non-admin user to VS Security property page so that
non-admin user can administer VS."

That's exactly i do just after installing VS. I log Administrator then
i setup some features and add this user for test administration.

I do a Rsop on my host to see what parameters are modified by group policy.
I don't see something special.

Where i must search/parameter change to allow toto ?

Regards.

"David Wang" <(email address - cut out)> a écrit dans le message de news:
(email address - cut out)...
You have to use the administrator to login to VS2005 admin website to
be able to add non-admin user to VS Security property page so that
non-admin user can administer VS.

This is no different than if you want to allow non-admin users to be
able to Remote Desktop into the server - you first use the
administrator to add a non-admin user to the Remote Desktop Users group
and then you can Remote Desktop to this server with that non-admin
user.

403 19 with error 1314 usually happens when you launch a CGI (such as
VS2005 admin CGI EXE) with an Application Pool Identity that does not
have several necessary privileges. This usually happens if you used a
custom Application Pool Identity in IIS, or your domain has a group
policy which removed those privileges from the IIS Application Pool
Identity.

I suspect your domain group policy is accidentally locked down to
prevent VS2005 from working with a user like toto. Seen it many times
before.

//David
http://w3-4u.blogspot.com
//

Caius Bonus wrote:

Show quoted text

> Hi,
>
> First test, from my client i set https://srv/ , no certificate popup and
> access denied see log :
>
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 401 2 2148074254
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 401 1 0
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /Default.htm - 443
> MyDOMAIN\toto
> 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 200 0 0
> 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> view=1 443 MyDOMAIN\toto 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 403 19 1314
>
> Second test, i set https://192.168.0.14, i got and validate the
> certificate
> popup but always access denied :
>
> 2006-10-27 09:01:54 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 401 2 2148074254
> 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 401 1 0
> 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /Default.htm - 443
> MyDOMAIN\toto
> 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 200 0 0
> 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> view=1 443 MyDOMAIN\toto 192.168.1.2
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> 403 19 1314
>
> I check the link but im sorry i don't find the HOWTO set non administrator
> to display VS web administration.
>
> When i inserted my user toto in the web admin security panel i got no
> error
> and the domain was automatically added.
> I checked DCOM options but all seems right.
>
> Hope this help !
>
>
> "David Wang" <(email address - cut out)> a écrit dans le message de news:
> (email address - cut out)...
> > Non-admin cannot administer VS2005 by default. You need to make
> > additional configuration to allow non-admin to administer VS2005.
> >
> > http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-2005-Administration-on-IIS.aspx
> >
> > If you believe that everything is properly configured, then can you
> > please provide the IIS log entry for the request that returned the 403
> > so that we can troubleshoot your configuration.
> >
> > It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is the
> > ID of the Virtual Server Admin website.
> >
> > In particular, I want the HTTP sub-status code of the 403 because it
> > will directly tell you what is wrong and how to fix it.
> >
> >
> >
> > //David
> > http://w3-4u.blogspot.com
> > //
> >
> >
> > Caius Bonus wrote:
> >> Hi,
> >>
> >> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can launch
> >> the
> >> browser and add a user in security panel.
> >>
> >> But impossible for that user to browse the web administration from any
> >> computer. Page is ERROR 403 Access DENIED.
> >>
> >> When i put this user in the default local administrators group, access
> >> is
> >> ok.
> >>
> >> What's wrong ?
> >>
> >> Regards.
> >

Re: web administration [SOLVED]

Sent: 10/27/2006
From: "Caius Bonus" <caiusATbonusland.com>
Message:

Hi,

I ve solved the problem, i create an OU under my Servers OU in which i
placed my host.
I apply on it a group policy modifying 2 parameters :

Under "User Rights Assignment", find "Replace a process-level token" and
"Adjust memory Quotas for a Process" and add your user to both.

After a reboot of my host, i could access web admin from toto !

I need now to test some group/delegation VM with VS, but all seems ok.

Thanks for all.

"David Wang" <(email address - cut out)> a écrit dans le message de news:
(email address - cut out)...
It depends on where you are getting denied access.

If the user "toto" is getting the 403.19 Forbidden error, then that
happens before any of your VS Security settings take place -- so you
need to first fix that issue at the IIS admin website level first.

After that is taken care of, then VS Security settings apply when the
user tries to manipulate Virtual Machines.

VS Security has nothing to do with Group Policy. IIS Security also has
nothing to do with Group Policy. You just look at the error codes and
diagnose them in the right sequence of importance.

//David
http://w3-4u.blogspot.com
//

Caius Bonus wrote:

Show quoted text

> Re,
>
> "You have to use the administrator to login to VS2005 admin website to
> be able to add non-admin user to VS Security property page so that
> non-admin user can administer VS."
>
> That's exactly i do just after installing VS. I log Administrator then
> i setup some features and add this user for test administration.
>
> I do a Rsop on my host to see what parameters are modified by group
> policy.
> I don't see something special.
>
> Where i must search/parameter change to allow toto ?
>
>
> Regards.
>
>
> "David Wang" <(email address - cut out)> a écrit dans le message de news:
> (email address - cut out)...
> You have to use the administrator to login to VS2005 admin website to
> be able to add non-admin user to VS Security property page so that
> non-admin user can administer VS.
>
> This is no different than if you want to allow non-admin users to be
> able to Remote Desktop into the server - you first use the
> administrator to add a non-admin user to the Remote Desktop Users group
> and then you can Remote Desktop to this server with that non-admin
> user.
>
> 403 19 with error 1314 usually happens when you launch a CGI (such as
> VS2005 admin CGI EXE) with an Application Pool Identity that does not
> have several necessary privileges. This usually happens if you used a
> custom Application Pool Identity in IIS, or your domain has a group
> policy which removed those privileges from the IIS Application Pool
> Identity.
>
> I suspect your domain group policy is accidentally locked down to
> prevent VS2005 from working with a user like toto. Seen it many times
> before.
>
>
> //David
> http://w3-4u.blogspot.com
> //
>
>
> Caius Bonus wrote:
> > Hi,
> >
> > First test, from my client i set https://srv/ , no certificate popup and
> > access denied see log :
> >
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 401 2 2148074254
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET / - 443 - 192.168.160.26
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 401 1 0
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /Default.htm - 443
> > MyDOMAIN\toto
> > 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 200 0 0
> > 2006-10-27 08:57:35 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> > view=1 443 MyDOMAIN\toto 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 403 19 1314
> >
> > Second test, i set https://192.168.0.14, i got and validate the
> > certificate
> > popup but always access denied :
> >
> > 2006-10-27 09:01:54 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 401 2 2148074254
> > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET / - 443 - 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 401 1 0
> > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /Default.htm - 443
> > MyDOMAIN\toto
> > 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 200 0 0
> > 2006-10-27 09:02:07 W3SVC2 192.168.0.14 GET /VirtualServer/VSWebApp.exe
> > view=1 443 MyDOMAIN\toto 192.168.1.2
> > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> > 403 19 1314
> >
> > I check the link but im sorry i don't find the HOWTO set non
> > administrator
> > to display VS web administration.
> >
> > When i inserted my user toto in the web admin security panel i got no
> > error
> > and the domain was automatically added.
> > I checked DCOM options but all seems right.
> >
> > Hope this help !
> >
> >
> > "David Wang" <(email address - cut out)> a écrit dans le message de news:
> > (email address - cut out)...
> > > Non-admin cannot administer VS2005 by default. You need to make
> > > additional configuration to allow non-admin to administer VS2005.
> > >
> > > http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual-Server-2005-Administration-on-IIS.aspx
> > >
> > > If you believe that everything is properly configured, then can you
> > > please provide the IIS log entry for the request that returned the 403
> > > so that we can troubleshoot your configuration.
> > >
> > > It is located at %SYSTEMROOT%\System32\LogFiles\W3SVC# where # is the
> > > ID of the Virtual Server Admin website.
> > >
> > > In particular, I want the HTTP sub-status code of the 403 because it
> > > will directly tell you what is wrong and how to fix it.
> > >
> > >
> > >
> > > //David
> > > http://w3-4u.blogspot.com
> > > //
> > >
> > >
> > > Caius Bonus wrote:
> > >> Hi,
> > >>
> > >> Just new install VS 2005 R2 on W2K3 R2 STD, on the server i can
> > >> launch
> > >> the
> > >> browser and add a user in security panel.
> > >>
> > >> But impossible for that user to browse the web administration from
> > >> any
> > >> computer. Page is ERROR 403 Access DENIED.
> > >>
> > >> When i put this user in the default local administrators group,
> > >> access
> > >> is
> > >> ok.
> > >>
> > >> What's wrong ?
> > >>
> > >> Regards.
> > >

Post Reply | This is Spam! | Mark as Spam

Other groups

Virtual PC (Mac)(3592)	Virtual PC(12844)	Virtual PC (French)(496)
Virtual Server 2005(6245)

Our Sponsors

Virtual Server 2005 Info Here!
http://www.aspdeveloper.net

Wiki

Blogs

Articles

Image galleries

File galleries

Forums

Maps

Directories

ASP Developer Network (since 1996) - Brought to you by Steve Radich and BitShop, Inc. - http://www.bitshop.com
Copyright © 1997-2005 by BitShop, Inc. All Rights Reserved.
No content may be reproduced in any form without written permission from BitShop, Inc.
We will be honored to assist with reproduction rights on our material if you contact us.
We also can provide print articles for your magazine, private training seminars at your site, and conference presentations.
Thank you for visiting. Please bookmark our site if you found it useful!
If you wish to make a donation it will help further the development of these free resources: