“A required privilege is not held by the client.”

Question

I have iis5 on xp. Everything was working until I had to change the user account of the iis windows service from Local System to another user (details).

Now iis is up but when I surf it I get:

"A required privilege is not held by the client."

How to fix it?

Answer 1

Could you give more details?

My first instinct is to ask if the account that you're running IIS doesn't have rights to run as a service (but that doesn't quite match the error's wording.)

Just for sanity's sake, Have you granted the user "Run as a Service" privelige via the Local Security Policy?

UPDATE 1: AH-HA! (First, you did restart the IIS service after you made that change, right? If it still doesn't work...) Remove the "Run as a Service" right and grant it the "Act as part of the operating system" right, and then restart the www service. Also, for sanity's sake, clear your browser cache. It shouldn't be a problem, but ...

UPDATE 2: Since you're running an ASP application (that's an important piece of information...), follow the steps described here and here

Also:

• Instructions on how to create a service account for ASP.NET
• List of directories to which the ASP.NET service account needs permissions

Answer 2

I am unsure but same as gWaldo said it may be a setting in the Local Security Policy

i believe that you need to enable Impersonate a client after authentication (i may be wrong)

From Microsoft

To work around this problem, verify that the ASPNET account has the correct user rights as follows:

%windir%\Microsoft.NET\Framework\Version\Temporary ASP.NET Files: Full Control

%windir%\Temp: Full Control

Application folder: Read

%installroot% hierarchy (for example, %windir%\Microsoft.Net\Framework\Version): Read

%windir%\Assembly: Read

Note This is the global assembly cache. You cannot directly use Windows Explorer to edit ACLs for this folder. Instead, open a command window, and then run the following command:

cacls %windir%\assembly /e /t /p domain\useraccount:R

Alternatively, before you use Windows Explorer, run the following command to unregister Shfusion.dll: regsvr32–u shfusion.dll

After you set user rights in Windows Explorer, run the following command to re-register Shfusion.dll: regsvr32 shfusion.dll

Web site root (for example, %root%\Inetpub\Wwwroot) or the path that the default Web site points to: Read %windir%\System32: Read

(Typically, the ASPNET account has already been granted user rights as a member of the Users group.)