I am working on a website running Sitecore 6.3.1 on a Windows Server 2008 R2 instance.

Everything was working beautifully until I copied some static files (CSS, JS, images) from a ZIP archive provided by one of our frontend developers into C:\Inetpub\wwwroot\(website name)\Website\static.

Now, any time I try to access any of those static files (e.g., http://localhost/static/css/main.css), I get a 401.3 error (according to C:\inetpub\logs\LogFiles\W3SVC2\u_ex110216.log).

The Sitecore application itself is working just fine, and the static files were perfectly accessible until I replaced them with the updated files.

According to every resource I could find on the subject, a 401.3 error indicates that the ACL for the requested resource is not permitting access to the IIS user account.

  • I looked at the ACL for a file that is currently working (e.g., C:\Inetpub\wwwroot\(website name)\Website\default.css), and it appears to be identical to that of the static files that are inaccessible.

  • I checked the application pool settings for the Sitecore site, and the anonymous user is "IUSR". Following the instructions in this thread, I gave the IUSR account read and execute permissions for the C:\Inetpub\wwwroot\(website name)\Website\static directory and recursively applied it to all subfolders and files in that directory. No dice.

  • Based on the suggestions offered in this thread, I tried removing the static directory entirely and recreating it and its subdirectories by hand so that they inherit permissions from the parent Website directory. However, the problem persisted.

What else can I try to resolve these 401.3 errors?


I had a similar problem with my web site on Windows Server 2008:

  • Forms and anonymous authentication enabled
  • Granted full access on the folder to the application pool user
  • Granted full access on the folder to the iis_iusrs group

To test I used two pages:

  • hello.html
  • hello.aspx

hello.aspx came up just fine. hello.html threw a 401.3 unauthorized. Microsoft sysinternals procmon reported "ACCESS DENIED" on hello.html by the application pool user when I tried to browse to the page.

To resolve the problem I added the user IUSR to the access control list for the web site folder. IUSR is not listed in the Windows management tool users list, but it comes up if you search for it when adding a user in the folder properties security tab.

I found it very strange (and confusing) that procmon reported the user trying to access hello.html was the application pool user, and not iusr.


I discovered what was causing the problem:

It turns out that the "Encrypt contents to secure data" attribute was set for each of the files.

I accessed the properties for each file and unchecked that checkbox (right-click -> Properties -> Advanced... (next to Attributes) -> uncheck Encrypt contents to secure data), and everything is back to normal.


I had a similar issue today, and what fixed it for me was your second point about giving the IUSR account read and modify permissions on the files and directories (it wasn't just the static files that I was dealing with)


Check that the Application Pool Identity has permissions on the site and for network services.

  • 4
    How? A few steps will help a lot. – user30804 Jul 3 '11 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy