1

We are working to certify our application for deployment on Windows Server 2008 and having some configuration issues.

The following code throws an interop error:

On Error Resume Next
Set WordApp = Server.CreateObject("word.application")
If Err.number <>0 Then
  SetErrorDesc ErrorDesc, "Unable to instantiate word. (" & err.Description & ")<br>"
  SetErrorStatus ErrorStatus,True
End If

The error information returned in err.Description is: 

006~ASP 0178~Server.CreateObject Access Error~The call to Server.CreateObject failed while checking permissions. Access is denied to this object.

The site is configured to use a specific user account for its application pool. The site is a mixed-mode ASP.Net and asp-classic application. I have checked out Ogawa's solution regarding the need for the systemprofile to have a Desktop folder, and for the AppPool to be configured to load the user profile. The Word 97-2003 Document DCOM object is configured to run as the same user as the site's app pool. Launch and Activation, Access Permissions, and Configuration Permissions all that the user added with full permissions set.

Edited to add: When running interactively, this script (running under cscript or wscript) successfully creates the Word.Application and extracts the username:

var wordobj = new ActiveXObject("Word.Application");
WScript.echo(wordobj.UserName);
wordobj.quit();

Clearly not a duplicate of Error creating Word object in classic ASP on IIS7 as we are getting the error on the CreateObject for Word.Application rather than when opening a document.

The server is Windows 2008 x86.

What have I missed in configuring this?

Community
  • 1
  • 1
Tetsujin no Oni
  • 7,300
  • 2
  • 29
  • 46
  • Have you confirmed that a simple .VBS run interactively from the same account on the same machine can create the object? – AnthonyWJones Jan 24 '12 at 13:39
  • 1
    @AnthonyWJones Yes, the interactive scenarios work fine. (used jscript, but the principle is the same. See edit. – Tetsujin no Oni Jan 24 '12 at 14:34
  • There is some discussion about server security permissions in this post which may help (down towards bottom page) http://forums.devx.com/showthread.php?t=12914 – Dee Jan 21 '12 at 19:57
  • 1
    Unfortunately, running as Administrator is most definitely not an acceptable solution. We are already configuring DCOM for Word to run as a specific user account for which we are managing security separately. That user can interactively launch Word with no issues from an RDP session on this server. – Tetsujin no Oni Jan 21 '12 at 22:51

4 Answers4

4

After burning a support incident from our MSDN subscription, this is what we found:

On IIS7, you must configure the process identity in both the AppPool and the application's Anonymous Authentication. If you are running mixed ASP and ASP.NET, you can configure Anonymous Authentication (in the site's Authentication details) to point to the AppPool's identity, or use a specific username/password combination.

The default of Anonymous Authentication is IUSR, not the Application Pool identity.

If anyone knows the proper invocation of appcmd.exe to set the application pool identity passthrough, it'd be great in a comment.... though our script could simply use the same username/password combination here, it'd be better to reduce the number of locations in which it is stored by one.

Tetsujin no Oni
  • 7,300
  • 2
  • 29
  • 46
  • Wow. I know it's a bad idea to call Office applications from ASP.NET because they assume they're running in a desktop environment. I didn't know it was ok in a classic ASP application. – John Saunders Sep 15 '12 at 01:09
  • 1
    I wouldn't term it "OK". It does something that is needed and doesn't have a good story for doing it another way in the application that we were working on here. – Tetsujin no Oni Sep 16 '12 at 04:02
  • 1
    Surely one could spin up an interactive process and have it run the Office application. One would then communicate with that process over WCF. The WCF client could be wrapped in a COM-visible wrapper, for use in the ASP application. – John Saunders Sep 16 '12 at 06:10
  • That's definitely not an appropriate solution to the problem being discussed here. Better would be migration to using the Aspose libraries. – Tetsujin no Oni Sep 17 '12 at 04:10
  • I didn't mean to suggest this was an optimal solution. It does, however, preserve most of the existing code. – John Saunders Sep 17 '12 at 04:40
  • This was a refinement of verification code to ensure the existence of MS Office for use by a third party component... – Tetsujin no Oni Sep 18 '12 at 00:24
1

I haven't had to troubleshoot server-side Word automation issues for a very long time, but I'll take a stab at it.

One of the reasons we used to see this issue is because the user profile would not load up. It could have been an improper configuration on our part, but maybe you are running into the same issue.

Here's how we worked around it:

  1. Make sure a user profile exists for the AppPool user by logging onto the IIS server as that user.
  2. Create and install a Windows Service that does nothing. Or you can use an existing service that serves no purpose (Fax).
  3. Configure the service to "Log on as:" the same user as the AppPool.
  4. Set the "Startup Type" to Automatic.
  5. Make sure it is running.

We are essentially running a service as the AppPool user as a way of keeping the user profile open. Hopefully, this can at least eliminate the possibility that it is a user profile issue.

John Allers
  • 3,052
  • 2
  • 30
  • 36
0

Please check the below link answered by Ogawa, which worked like a charm for me by creating folder

C:\Windows\System32\config\systemprofile\Desktop

http://social.msdn.microsoft.com/Forums/en-US/innovateonoffice/thread/b81a3c4e-62db-488b-af06-44421818ef91?prof=required

Ravi Vanapalli
  • 9,805
  • 3
  • 33
  • 43
-1

Just try to find a user that has been set up on your local machine or server. Obviously IUSR_UNKNOWN doesn't have a "My documents" folder and Microsoft hasn't given this strange person access to your Word documents through the registries current user session. So good luck trying to convince Microsoft that this person is allowed access.

Instead create a new user or a domain user and give it local admin access (for administrative purposes) or a regular user account for normal usage. And set him up with an account on your local computer or server. Walla. No more stupidification.

RetroCoder
  • 2,597
  • 10
  • 52
  • 81