2

I am trying to set up Web Deploy on an IIS 10 server running on Windows Server 2019. The Web Management Service must be running in order for this to occur, but it will not start.

I installed the Windows feature and can see the appropriate Windows service in service management. Unfortunately, when I try to start either through Service Manager or IIS's management tool, it fails. The Windows application event logs contain the following error:

The Web Management Service service terminated with the following service-specific error: Access is denied.

enter image description here

And... that's it.

Here's my IIS Management Studio screen: enter image description here

The closest I've been able to find to an answer is this, which didn't help.

Improve this question
3
  • Check in services.msc if you can find the Web Management Service, what can you see there ?
    – Swisstone
    May 8, 2020 at 16:40
  • @Swisstone Yes, it's listed as Manual start. When I try to start the service from there, I get the same problem.
    – EJoshuaS - Stand with Ukraine
    May 8, 2020 at 16:47
  • Run Process Monitor, and then reproduce the issue. Then from Process Monitor log, locate any access denied log entries and check if they are related.
    – Lex Li
    May 9, 2020 at 11:01

1 Answer 1

Reset to default
2

The Web Management Service will fail to start with a "Code 5" error in the console and an "Access Denied" event in the Windows security logs if you have the Block untrusted fonts policy enabled. This is a known issue that has been fixed as of build 1903.

Here's the Microsoft Tech Community post from a Microsoft support escalation engineer that solved this exact problem for me. https://techcommunity.microsoft.com/t5/iis-support-blog/wmsvc-web-management-service-failing-to-start-with-quot-access/ba-p/770603

It is likely that the block untrusted fonts setting is enabled on your server either by registry, local policy, or domain-based group policy. In my environment, I created a policy that only applies to Windows Server 2019 machines and disabled the following setting:

Computer Settings > Administrative Templates > System > Mitigation Settings > Untrusted Font Blocking

After running gpupdate and rebooting, the service started successfully.

Improve this answer
1
  • 1
    For those concerned with the security implications, Microsoft (see link) feels that other protections in place justify disabling this setting. Also Duncan Clay in Sam's linked article includes a registry settings to grant an exception to wsman.exe if Group Policy is not an option or for testing. techcommunity.microsoft.com/t5/microsoft-security-baselines/…
    – RiverHeart
    Feb 9, 2022 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.