0

We had every website on one machine suddenly start returning 401.3 errors this morning. After much poking around we fixed the problem by changing the IIS Anonymous Authentication to use the application pool identity.

From the IIS logs, we know exactly when the website switched from 200 to 401.3 responses, and there was a vendor in the machine at the time. I have good reason to believe that the websites were using the IUSR previously, and that somehow, the vendor did something to remove IUSR from the IIS_IUSRS group, OR removed IUSR permissions. However, when I try to replicate on a sister box, I see that the website on the sister box is running under IUSR but 1) None of the directories have IUSR permission (just IIS_IUSRS) 2) The IIS_IUSRS group only has a SID as a member + the Default Application Pool Yet the website on the sister box is humming along just fine! How could someone remove IUSR permissions from the directory when they are not listed, or from IIS_IUSRS when the user is not listed?

Improve this question
4
  • Is there a Users ACL on the other box as well? IUSR is a member of Users.
    – MDMarra
    Apr 5, 2013 at 19:43
  • In theory - but IUSR doesn't list on either box under local users. I tried using stackoverflow.com/questions/4548476/… to see it, but no go there either.
    – jowensboggs
    Apr 5, 2013 at 19:47
  • Whoops, IUSR has been a built-in service account similar to Local SYSTEM and NETWORK SERVICE since Server 2008, so it wouldn't be a member of Users. My bad!
    – MDMarra
    Apr 5, 2013 at 19:58
  • After some thought, I'm pretty sure what happened may have had nothing to do with removing IUSR. It's possible that they removed the MACHINE\Users permissions for the directory. I was assuming that IUSR would be given access rights to web directories, but I can't see that being the case on any machine - instead it's IIS_USRS (which from my understanding the AppPool accounts belong to) and MACHINE\Users. IUSR is allowed access because MACHINE\Users has access?
    – jowensboggs
    Apr 5, 2013 at 21:23

1 Answer 1

Reset to default
0

One tool that is helpful in troubleshooting would be process monitor. From your description the USERS would be a good culprit. The local users group contains 'authenticated users', which would contain a token for authenticated.

http://www.iislogs.com/articles/processmonitorw3wp/

btw - why are you letting a vendor access to your server? :)

Improve this answer
1
  • Ultimately the solution is to limit access to the server!
    – jowensboggs
    Apr 7, 2013 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .