FIX: ASP.NET Does Not Work
with the Default ASPNET Account on a Domain Controller
The information in this
article applies to:
- Microsoft ASP.NET (included with the .NET Framework)
1.0
- Microsoft Internet Information Services 5.0
- Microsoft Mobile Internet Toolkit (MMIT)
This article was previously
published under Q315158
SYMPTOMS
After you install
Microsoft Visual Studio .NET or the Microsoft .NET Framework on a domain
controller or on a backup domain controller, if you try to run an ASP.NET
application, the browser displays the following error message:
Server Application
Unavailable
The web application you are attempting to access on this web
server is currently unavailable.
Please hit the "Refresh" button in your
web browser to retry your request.
Furthermore, the following
event is logged in the system application event log:
aspnet_wp.exe could not be
launched because the username and/or password supplied in the processModel
section of the config file are invalid.
aspnet_wp.exe could not be
started.
HRESULT for the failure: 80004005
This applies to Internet
Information Services (IIS) version 5.0 or later.
CAUSE
By default, ASP.NET runs its
worker process (Aspnet_wp.exe) with a weak account (the local machine account,
which is named ASPNET) to provide a more secure environment. On a domain
controller or on a backup domain controller, all user accounts are domain
accounts and are not local machine accounts. Therefore, Aspnet_wp.exe fails to
start because it cannot find a local account named "localmachinename\ASPNET". To
provide a valid user account on the domain controller, you must specify an
explicit account in the <processModel> section of the Machine.config file,
or you must use the SYSTEM account.
NOTE: If you try to
debug (click the Start button) before you try to browse to the
page you can experience the exact same problem.
RESOLUTION
To work around this
problem, use one of the following methods:
- Create a weak account that has the correct
permissions, and then configure the <processModel> section of the
Machine.config file to use that account.
- Set the userName attribute to
SYSTEM in the <processModel> section of the
Machine.config file.
- Configure the <processModel> section of the
Machine.config file to use an administrator account.
NOTE: Allowing ASP.NET
applications to run as SYSTEM or an administrator account has serious security
implications. If you use either of these workarounds, code that is run in the
Aspnet_wp.exe process will have access to the domain controller and the domain
settings. Executable files that are started from the Aspnet_wp.exe process run
in the same context and also have access to the domain
controller.
Therefore, Microsoft recommends that you use the first
workaround. To use the first workaround, follow these steps:
-
Create a user account on the computer
named ASPUSER, and then add this account to the Users
group.
NOTE: You can also use the ASPNET account that
the .NET Framework created if you change the password on this account. You
must know the password on this account because you add the password to the
<processModel> section later in these steps.
-
Grant the ASPUSER or the ASPNET account
the Log on as a batch job user right. Make sure
that this change appears in the Local Security Policy
settings.
NOTE: To grant the Log
on as a batch job user right on this account, you may have to grant
this user right in each of the following security policies (From the Control
Panel/Administrative Tools):
NOTE: You may have
to reboot the server for these changes to take effect.
-
Make sure that the ASPUSER or the
ASPNET account has permission to access all of the necessary directories and
files to start the Aspnet_wp.exe process and to serve the ASP.NET pages.For
additional information about what permissions you must grant to this account,
click the article number below to view the article in the Microsoft Knowledge
Base:
317012 INFO: Process and Request
Identity in ASP.NET
-
Open the Machine.config file. The path
to the file is: %Systemroot%\Microsoft.NET\Framework\v1.0.3705\CONFIG.
-
In the <processModel> section of
the Machine.config file, change the userName and the
password attributes to the name and the password of the
account that you created in step 1. For example:
userName="DomainName\ASPUSER" password="ASPUSERpassword"
-
Save the changes to the Machine.config
file.
STATUS
Microsoft has confirmed that
this is a bug in the Microsoft products that are listed at the beginning of this
article. This bug was corrected in ASP.NET (included with the .NET Framework)
1.1.
REFERENCES
For additional
information about ASP.NET security, click the article number below to view the
article in the Microsoft Knowledge Base:
306590 INFO: ASP.NET Security
Overview
| Last Reviewed: |
3/21/2003 |
| Keywords: |
kbfix kbbug
kbConfig kbHttpRuntime kbreadme kbSecurity
KB315158 |
AMSS COMMUNITY
HUB