9

I am using VSTS 2008 + C# + .Net 3.5 + IIS 7.0. I have created a new web site and put an html file into the directory. And when I use browse function in IIS manager to browse the html file, I met with the following error, any ideas what is wrong?

BTW: I am very confused about unauthorized error since I run the worker process under administrator account. From the error message, I am confused why the logon method is anonymous and not using administrator account?

HTTP Error 401.3 - Unauthorized
You do not have permission to view this directory or page because of the access control list (ACL) configuration or encryption settings for this resource on the Web server.

Module IIS Web Core 
Notification AuthenticateRequest 
Handler StaticFile 
Error Cde 0x80070005 
Requested URL http://localhost:80/a.html 
Physical Path C:\test\simplehosttest\a.html 
Logon Method Anonymous 
Logon User Anonymous
Lex Li
  • 60,503
  • 9
  • 116
  • 147
George2
  • 44,761
  • 110
  • 317
  • 455

5 Answers5

17

C:\test\simplehosttest\a.html

Please grant IUSR account necessary rights on this file or its folder. Then 401.3 error will disappear.

Lex Li
  • 60,503
  • 9
  • 116
  • 147
  • I have already set the account for worker process to be administrator, why still has permission issue? Administrator should be more powerful than IUSR? – George2 Dec 13 '09 at 11:19
  • I have tried to add IUSR and it works, cool! Why using IUSR could solve my issue? This special user is used for? – George2 Dec 13 '09 at 11:40
  • 3
    IUSR is used as the default anonymous user account. That means when your site is anonymous accessible, in fact IIS uses IUSR account as the logon account for all users. Then you must grant IUSR necessary permissions on the folders so it can access them. – Lex Li Dec 14 '09 at 00:33
  • 2
    http://learn.iis.net/page.aspx/140/understanding-the-built-in-user-and-group-accounts-in-iis-70/ – Lex Li Dec 14 '09 at 00:34
15

In IIS 8.5 (fresh install) I had my application pool run as a custom identity and the files stored in a folder outside /inetpub/wwwroot. The identity had all the proper file privileges, but still I got an acl error.

After some struggles I found out that in IIS manager->My Site->Authentication->Anonymous Authentication->Edit the identity used for anonymous authentication was set to a specific user by default (IUSR). Setting it to use the application pool identity fixed it for me!

Matthijs Bos
  • 151
  • 1
  • 3
  • 1
    This immediately fixes it for me also, can anyone comment as to why this is defaulted to IUSR instead of `Application pool identity`? – Chris Marisic Apr 07 '14 at 18:02
1

I found another cause of this problem in that the website I was deploying was sent to me in a zip file. For some reason (maybe because the files were built on a Mac) the files where coming over with the Encrypted for Security bit set. The files show up as green in Windows Explorer.

Flory
  • 2,849
  • 20
  • 31
1

Basically you have to grant read access to the file to the identity that runs your apppool in IIS. On 2008 server and Vista that identity (unless you have explicitly changed it) would be "NT Authority\Network Service" and on windows7 it's "IisAppPool\AppPoolIdentity" (and don't ask why they have done that on win7, it's a WTF if you ask me)

Klaus Byskov Pedersen
  • 117,245
  • 29
  • 183
  • 222
  • I am confused, there is a user name called "AppPoolIdentity"? – George2 Dec 13 '09 at 11:20
  • I have tried to add html page permission to user "IUSR", and it works. Why using IUSR could solve my issue? This special user is used for? – George2 Dec 13 '09 at 15:53
  • 1
    I had IIS_IUSR added to file permissions, not 'IUSR'. Getting real tired of your crap microsoft – Dermot Dec 04 '13 at 01:08
0

I had the same problem, but neither of the suggested fixes solved my problem. I was trying to deploy an ASP.Net 4.0 web application with Forms Authentication on IIS7 on Windows Server 2008. What solved the problem was providing read and script permissions to the handlers, which can be accomplished by opening Handler Mappings and then selecting "Edit Feature Permissions" from the right menu.

Thea
  • 7,879
  • 6
  • 28
  • 40