>I just installed the Virtual Server 2005(sp2) from our Action Pack
> subscription on a Windows 2003 server (SP1). It said I had to install
> IIS so I did.
>
> After installing I tried to logon to the admin page but I get the
> error message "You are not authorized to view this page." I'm the
> ADMINISTRATOR on this DC! What the heck do I need to view the page?
>
> There is NOTHING in the documentation on this and I cannot use the
> software without this silly app. It's REALLY irritating as I've spent
> the better part of the day trying to find help on the WEB on this and
> MS's site (useless). All I get is FORBIDDEN and I don't know what.
>
> The only thing I found is that i have to logon with a local account.
> It's a DC...there ARE no local accounts! My admin account DOES have
> local logon access rights but that doesn't help. I've tried several
> accounts and nothing.
>
> Can somebody lend a hand here so I can get this fixed and go home?
>
> (can you tell I'm frustrated???)
>
> Thanks, all for any support.
>

> Here are the results of my attempts:
>
> --------------------< cut >--------------------
> You are not authorized to view this page
> You do not have permission to view this directory or page using the
> credentials that you supplied.
> --------------------------------------------------------------------------------
>
> Please try the following:
>
> Contact the Web site administrator if you believe you should be able to
> view
> this directory or page.
> Click the Refresh button to try again with different credentials.
> HTTP Error 403 - Forbidden: Access is denied.
> Internet Information Services (IIS)
>
> --------------------< cut >--------------------
>
> I verified that I have access to the VirtualServer folder under program
> files and I can run ActiveX controls. I don't know what else to check to
> make
> this work. And from what I can tell through the newsgroup this is not an
> uncommon issue.
>
> I wonder why Microsoft does not give users another way to administer the
> program? This is a total pain. (but thanks for your help!)
>
> -Fran-

>I would second that. I absolutely detest the fact that I have to install
>IIS and that I am forced through a browser interface. Never had to do that
>with VMWare.

>I would second that. I absolutely detest the fact that I have to install
>IIS

> On Sun, 1 Jan 2006 23:41:13 -0600, "Michael Hotek"
> <(email address - cut out)> wrote:
>
>>I would second that. I absolutely detest the fact that I have to install
>>IIS and that I am forced through a browser interface. Never had to do
>>that
>>with VMWare.
>
> You don't need to use IIS, that's just the default option. You could
> do all your admin via scripts or the command line.
>
> --
> Cheers,
> Steve Jain, Virtual Machine MVP
> http://vpc.essjae.com/
> "This posting is provided "AS IS" with
> no warranties, and confers no rights.
> You assume all risk for your use.
> I am not am employee of Microsoft."

> Here are the results of my attempts:
>
> --------------------< cut >--------------------
> You are not authorized to view this page
> You do not have permission to view this directory or page using the
> credentials that you supplied.
> --------------------------------------------------------------------------------
>
> Please try the following:
>
> Contact the Web site administrator if you believe you should be able to
> view
> this directory or page.
> Click the Refresh button to try again with different credentials.
> HTTP Error 403 - Forbidden: Access is denied.
> Internet Information Services (IIS)
>
> --------------------< cut >--------------------
>
> I verified that I have access to the VirtualServer folder under program
> files and I can run ActiveX controls. I don't know what else to check to
> make
> this work. And from what I can tell through the newsgroup this is not an
> uncommon issue.
>
> I wonder why Microsoft does not give users another way to administer the
> program? This is a total pain. (but thanks for your help!)
>
> -Fran-

> DCPromo was run about 3 weeks ago when the server was joined to the
> network.
>
> IIS was installed the day I installed VirtualServer 2005 R2 (which was
> last week.)
>
> Per your request, here are the results from the log file.
>
> Thanks for any insight!
> -Fran-
>
> ----------------< cut >------------------------
> #Software: Microsoft Internet Information Services 6.0
> #Version: 1.0
> #Date: 2006-01-02 01:34:19
> #Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query
> s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus
> sc-win32-status
> 2006-01-02 01:34:19 W3SVC2 10.21.20.20 GET /VirtualServer/VSWebApp.exe
> view=1 1024 - 10.21.20.20
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322)
> 401 2 2148074254
> 2006-01-02 01:34:25 W3SVC2 10.21.20.20 GET /VirtualServer/VSWebApp.exe
> view=1 1024 HLS-VSVR1\Fran 10.21.20.20
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322)
> 403 19 1314
> 2006-01-02 01:40:21 W3SVC2 10.21.20.20 GET /VirtualServer/VSWebApp.exe
> view=1 1024 - 10.21.20.20
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322)
> 401 2 2148074254
> 2006-01-02 01:40:29 W3SVC2 10.21.20.20 GET /VirtualServer/VSWebApp.exe
> view=1 1024 Fran 10.21.20.20
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322)
> 403 19 1314
> 2006-01-02 01:42:04 W3SVC2 10.21.20.20 GET /VirtualServer/VSWebApp.exe
> view=1 1024 - 10.21.20.20
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322)
> 401 2 2148074254
> 2006-01-02 01:42:10 W3SVC2 10.21.20.20 GET /VirtualServer/VSWebApp.exe
> view=1 1024 Fran 10.21.20.20
> Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322)
> 403 19 1314
> ----------------< cut >------------------------
>
>
>
>
>>Can you provide the IIS web log entry that corresponds to your request. I
>>need the HTTP status, sub-status, and Win32 error codes of that logged
>>request.
>>
>>There are over 20 subcategories of "403 Forbidden", so while seeing a 403
>>is
>>not uncommon, they are not all the same and have different solutions to
>>each. My quick guess is that it is a generic 403, which isn't something I
>>have come across yet with VS2005R2.
>>
>>Now, the issue may be unrelated to Virtual Server altogether since IIS6
>>and
>>Domain Controller does not really work together. Can you tell me the order
>>in which you:
>>1. Installed IIS6
>>2. Installed VS2005R2
>>3. Ran DCPROMO
>>
>>And can you check if retrieving /pagerror.gif works on the server.

>Can you provide the IIS web log entry that corresponds to your request. I
>need the HTTP status, sub-status, and Win32 error codes of that logged
>request.
>
>There are over 20 subcategories of "403 Forbidden", so while seeing a 403 is
>not uncommon, they are not all the same and have different solutions to
>each. My quick guess is that it is a generic 403, which isn't something I
>have come across yet with VS2005R2.
>
>Now, the issue may be unrelated to Virtual Server altogether since IIS6 and
>Domain Controller does not really work together. Can you tell me the order
>in which you:
>1. Installed IIS6
>2. Installed VS2005R2
>3. Ran DCPROMO
>
>And can you check if retrieving /pagerror.gif works on the server.

>Did the default website start successfully? What are the exact steps you
>are using to log in?

>
>http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual_Server_2005_Administration_on_IIS.aspx
>
>It is all supported out-of-the-box... the only problem being that only a CGI
>WebAdmin is provided by default.
>
>Hmm. At some point I should just publish the admin script of mine... since
>it is just a thin commandline access to the VS COM API... but it is pretty
>cool to be able to create, customize, and start a VirtualMachine on another
>server given one commandline. :-)

>Ok, you are getting 403.19, Win32 Error = 1314, which means that the IIS
>worker process identity assigned to execute the Virtual Server CGI EXE lacks
>sufficient privileges to launch the CGI.
>
>The most common causes are:
>1. User customized the worker process identity to one which has insufficient
>privileges
>2. The process identity somehow had necessary privileges removed from it.
>The most common missing ones are:
> - Adjust memory quotas for a process
> - Replace a process level token
>
>
>This state does not occur by default. It usually happens due to a
>user-applied security lockdown on the DC or user-applied lockdown via Group
>Policy to a Domain Machine.
>
>The correct fix is to determine the default WS03 user privilege which was
>removed by some arbitrary user process and restore it to the worker process
>identity in use.
>
>A band-aid "proof-of-concept" hack is to change the worker process identity
>of the Application Pool used by Virtual Server Admin Website to "Local
>System" and things should work.
>
>In other words, it is quite... challenging for IIS, let alone Windows as a
>system, to defend against an Administrator-initiated DoS... regardless if
>the administrator realizes it or not. :-)

> Excellent! Now how do I do that? (i.e. how do I find and change a user
> process?) By default the WS03 comes with the IE restricted policy
> enabled (IE High Security). I went to Windows components in Add/Remove
> Programs and unchecked that high security feature but still I cannot
> access this. Is there something else I must do?
>
>>Ok, you are getting 403.19, Win32 Error = 1314, which means that the IIS
>>worker process identity assigned to execute the Virtual Server CGI EXE
>>lacks
>>sufficient privileges to launch the CGI.
>>
>>The most common causes are:
>>1. User customized the worker process identity to one which has
>>insufficient
>>privileges
>>2. The process identity somehow had necessary privileges removed from it.
>>The most common missing ones are:
>> - Adjust memory quotas for a process
>> - Replace a process level token
>>
>>
>>This state does not occur by default. It usually happens due to a
>>user-applied security lockdown on the DC or user-applied lockdown via
>>Group
>>Policy to a Domain Machine.
>>
>>The correct fix is to determine the default WS03 user privilege which was
>>removed by some arbitrary user process and restore it to the worker
>>process
>>identity in use.
>>
>>A band-aid "proof-of-concept" hack is to change the worker process
>>identity
>>of the Application Pool used by Virtual Server Admin Website to "Local
>>System" and things should work.
>>
>>In other words, it is quite... challenging for IIS, let alone Windows as a
>>system, to defend against an Administrator-initiated DoS... regardless if
>>the administrator realizes it or not. :-)

> "Network Service" is set at the IDENTITY. I opened the SecPol.msc but
> I'm not sure what Key(s) to check and what policies.
>
> We're close here, David... if you can be more explicit I'm sure I can
> get this done on the next round.
>
> -Fran-

> VirtualServer is installed under DefaultAppPool in IIS6.
>
> As for NETWORK SERVICES the ONLY thing I found this under was the
> right: "Logon as a service"
>
> I DID, however, find IIS_WPG in a couple of places (i.e. "Impersonate
> a client after authentication" and "Logon as a batch job")
>
> -Fran-

>A solution would be nice. The BLOG info is interesting from an
> academic point of view but I don't need to understand the physics or
> theories of why a fire burns when all I need is an extinguisher.
>
> Does anyone have a working solution to this? At this point I could
> care less how the CGI interface works or how many different ways I
> could access this (C#, VBScript, JScritp, etc)...what I need is a real
> solution. I need to access the admin page, create a virtual server
> file and start using this or scrap the whole thing and go another way.
>
> Thanks, all for the conversation...
>
> -Fran-
>
>>
>>http://blogs.msdn.com/david.wang/archive/2005/06/21/Virtual_Server_2005_Administration_on_IIS.aspx
>>
>>It is all supported out-of-the-box... the only problem being that only a
>>CGI
>>WebAdmin is provided by default.
>>
>>Hmm. At some point I should just publish the admin script of mine... since
>>it is just a thin commandline access to the VS COM API... but it is pretty
>>cool to be able to create, customize, and start a VirtualMachine on
>>another
>>server given one commandline. :-)

> My guess is either the DC promotion process
>

> I just installed the Virtual Server 2005(sp2) from our Action Pack
> subscription on a Windows 2003 server (SP1). It said I had to install
> IIS so I did.
>
> After installing I tried to logon to the admin page but I get the
> error message "You are not authorized to view this page." I'm the
> ADMINISTRATOR on this DC! What the heck do I need to view the page?
>
> There is NOTHING in the documentation on this and I cannot use the
> software without this silly app. It's REALLY irritating as I've spent
> the better part of the day trying to find help on the WEB on this and
> MS's site (useless). All I get is FORBIDDEN and I don't know what.
>
> The only thing I found is that i have to logon with a local account.
> It's a DC...there ARE no local accounts! My admin account DOES have
> local logon access rights but that doesn't help. I've tried several
> accounts and nothing.
>
> Can somebody lend a hand here so I can get this fixed and go home?
>
> (can you tell I'm frustrated???)
>
> Thanks, all for any support.