8

I am working on a website running Sitecore 6.3.1 on a Windows Server 2008 R2 instance.

Everything was working beautifully until I copied some static files (CSS, JS, images) from a ZIP archive provided by one of our frontend developers into C:\Inetpub\wwwroot\(website name)\Website\static.

Now, any time I try to access any of those static files (e.g., http://localhost/static/css/main.css), I get a 401.3 error (according to C:\inetpub\logs\LogFiles\W3SVC2\u_ex110216.log).

The Sitecore application itself is working just fine, and the static files were perfectly accessible until I replaced them with the updated files.

According to every resource I could find on the subject, a 401.3 error indicates that the ACL for the requested resource is not permitting access to the IIS user account.

  • I looked at the ACL for a file that is currently working (e.g., C:\Inetpub\wwwroot\(website name)\Website\default.css), and it appears to be identical to that of the static files that are inaccessible.

  • I checked the application pool settings for the Sitecore site, and the anonymous user is "IUSR". Following the instructions in this thread, I gave the IUSR account read and execute permissions for the C:\Inetpub\wwwroot\(website name)\Website\static directory and recursively applied it to all subfolders and files in that directory. No dice.

  • Based on the suggestions offered in this thread, I tried removing the static directory entirely and recreating it and its subdirectories by hand so that they inherit permissions from the parent Website directory. However, the problem persisted.

What else can I try to resolve these 401.3 errors?

1
  • After applying the IUSR permission changes, an IISreset is required to make it work.
    – StingyJack
    Dec 31, 2020 at 15:19

5 Answers 5

13

I had a similar problem with my web site on Windows Server 2008:

  • Forms and anonymous authentication enabled
  • Granted full access on the folder to the application pool user
  • Granted full access on the folder to the iis_iusrs group

To test I used two pages:

  • hello.html
  • hello.aspx

hello.aspx came up just fine. hello.html threw a 401.3 unauthorized. Microsoft sysinternals procmon reported "ACCESS DENIED" on hello.html by the application pool user when I tried to browse to the page.

To resolve the problem I added the user IUSR to the access control list for the web site folder. IUSR is not listed in the Windows management tool users list, but it comes up if you search for it when adding a user in the folder properties security tab.

I found it very strange (and confusing) that procmon reported the user trying to access hello.html was the application pool user, and not iusr.

1
  • Having my website coming from an UNC path, I wasn't able to configure the local IUSR. Instead, I had to configure the anonymous identity to come from the app pool, too, as described here.
    – Uwe Keim
    Aug 11, 2021 at 6:59
6

I discovered what was causing the problem:

It turns out that the "Encrypt contents to secure data" attribute was set for each of the files.

I accessed the properties for each file and unchecked that checkbox (right-click -> Properties -> Advanced... (next to Attributes) -> uncheck Encrypt contents to secure data), and everything is back to normal.

2

I had a similar issue today, and what fixed it for me was your second point about giving the IUSR account read and modify permissions on the files and directories (it wasn't just the static files that I was dealing with)

1

When using the application pool identity, be sure to:

  1. Give the app pool user read permissions at the root of the website; and modify permissions wherever is needed, i.e., logs. The user name will be in the form of iis apppool\user-name
  2. Set the website IIS auth to use the app pool identity: IIS Website > Authentication > Anonymous (enabled) > Edit > select “Application pool identity”

The 2nd point is important when you are seeing file system files being denied with a 401, while compiled files are served up fine.

0

Check that the Application Pool Identity has permissions on the site and for network services.

1
  • 6
    How? A few steps will help a lot.
    – user30804
    Jul 3, 2011 at 18:19

You must log in to answer this question.