I have a very simple MVC 4 application I'm trying to deploy to a Windows 2012 server.

Inconsistently, when navigating to the root of the web application (http://localhost/app), it returns a 403.14-Forbidden:

Detailed Error Information:

Module:            DirectoryListingModule
Notification:      ExecuteRequestHandler
Handler:           StaticFile
Error Code:        0x00000000
Requested URL:     http://localhost:80/test1/
Physical Path:     c:\apps\test1\
Logon Method:      Negotiate

The web application is:

  • Is a very vanilla VS2012 MVC4 Intranet template -- with only a tweak to a label to prove things were working.
  • runs in an Integrated v4.0 application pool
  • setup to use Windows authentication
  • application pool has a custom AD Identity assigned (so it can gain access to a SQL server)
  • application pool identity has read permissions in the c:\apps\test1 folder in which it is running
  • It's an MVC4 application, targeting .NET 4.0 currently -There's no default document in an MVC4 application (like a default.aspx), as there shouldn't need to be one.
  • I don't want to enable directory listings (as that's not the real error).
  • Installed: Roles / Web Server (IIS) / Appliation Development / (.NET 4.5 Extensibility, Application Initialization, ASP.NET 4.5, ISAP Extensions, ISAPI Filters, WebSocket Protocol)
  • Works locally on my machine in IISExpress on Windows 8
  • Has configured in web.config: <modules runAllManagedModulesForAllRequests="true" />
  • is set to precompiled during publish

When I change the precompiled option to false, the web application does not fail (in my testing at least, it seems to work consistently).

The reason I say it's inconsistent is that I've seen it work, then I've published, and the error returns. I can't find a pattern to the issue (and right now, I haven't been able to get it work again, at all).

The 403 is returned from a local or remote web browser.

I've had trouble finding a solution that isn't intended for older versions of Windows (like suggestions to reinstall ASP.NET which won't work on Windows 2012).

I really don't know what else to try.

  • Anything in IIS Error logs? Anything in Event (App or Security) logs? does netsh http show urlacl look sane? – Mark Mar 26 '13 at 18:47
  • Nothing in logs. I don't see anything odd in the netsh. It's a clean install of Windows 2012 too (other than the steps performed above). – WiredPrairie Mar 26 '13 at 18:55
  • 1
    If you're running IIS 8.5 on Windows 8, or Server 2012, you might find that running mvc 4/5 (.net 4.5) doesn't work in a virtual directory. If you create a local host entry in the host file to point back to your local machine and then point a new local IIS website to that folder (with the matching host header entry) you'll find it works then. – Mastro Apr 29 '14 at 2:22
  • @WiredPrairie did you ever get this working? I have a similar problem – Steven Dec 21 '15 at 17:03
  • @Steven - no. I did not (beyond not precompiling as I mentioned). – WiredPrairie Dec 21 '15 at 17:07

Just spotted "custom AD Identity" in there.

  1. make sure the new user actually has rights to read the file-system path even if there isn't anything in there.
  2. make sure the new user is in the IIS app group so it can talk to the metabase
  3. Check if kernel-mode auth is configured then depending on that:
    1. (if so) check that setspn doesn't have extra records
    2. (if not) consider bumping NTLM up above Kerberos in your auth negotiate list to see if that fixes the issue.

2012 is new enough that I don't know its error quirks but those are pretty all good places to start when getting 403 forbidden.

  • 1) The user can see static files in the folder structure (and has been added to read-only for the path). 2) Are you suggesting adding the AD user to the IIS_IUSR group? 3) Unfortunately, I don't know what to do specifically with your 3rd suggestion (as I don't understand it). – WiredPrairie Mar 26 '13 at 20:19

I have the same problem. I had searched so much time and did all instructions in this link. I've setup my application like yours; but it doesn't work at all. Finally, I found out that: When I choose precompile during publishing, I must set AssemblyCulture is empty string (In Properties/AssemblyInfo.cs file) For example:

[assembly: AssemblyCulture("")]

If I set like the following, it doesn't work

[assembly: AssemblyCulture("fr-FR")]

  • Unfortunately, my MVC project was already set that way: [assembly: AssemblyCulture("")]. – WiredPrairie Apr 2 '13 at 13:49

I had a similar problem, and my answer was this:


I had the add the IP of the machine accessing the service. I didn't know that this had been enabled.

  • I don't see the connection between the problem the machine is having and your solution? Users can get to the web site, it's just that ASP.NET MVC routing doesn't kick in when precompiled. – WiredPrairie Apr 1 '13 at 20:03
  • I'm sorry I missed that you have the problem localhost. Any errors regarding any files not compiled in the browser? – Schrute Apr 2 '13 at 2:17
  • I again don't understand your suggestion. The only error is listed above. What about localhost? This problem happens locally or remotely. – WiredPrairie Apr 2 '13 at 10:40

protected by Tom O'Connor Apr 22 '14 at 9:22

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.