locked
'Permission denied' in Windows 2003 & IIS6.0... RRS feed

  • Question

  • User1171030959 posted

    Hello,

    My script...

    +++++++++++++
    ...
    set WshShell = CreateObject("WScript.Shell")
    set WScriptObj = Server.CreateObject("WScript.Shell")
    inReturn=WshShell.run("C:\Program files\Syslog\Registration.exe",0,true)
    ' test with other process    inReturn=WshShell.run("c:\windows\system32\cmd.exe",0,true)
    ' test with other process    inReturn=WshShell.run("...notepad.exe",0,true)
    ...
    -------------------

    This script work from many years on Windows 2000 Server and IIS 5.0.
    Application was migrated to new server (Windows 2003 R2 SP2 & IIS 6.0).
    All is functionnaly except one execution problem:

    +++++++++++++
    Microsoft VBScript runtime error '800a0046'
    Permission denied
    /register_form.asp, line 34
    -------------------

    Line 34 is 'inReturn=WshShell.run("C:\Program files\Syslog\Registration.exe",0,true)'.

    The folder '"C:\Program files\Syslog\' where application executable is, was received full authorization
    for:

        everyone
        Internet guest account (IUSR_...)
        Network service
        Network
        Users
        ...

    In line 34  I can use many prgm with same result (Permission Denied)  !!!

    Any ideas...
    Thank's...

    Wednesday, February 13, 2008 8:51 AM

Answers

  • User-823196590 posted

    http://support.microsoft.com/kb/812614

    Make sure IIS_WPG has access to C:\Program FIles\Syslog.

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Wednesday, February 13, 2008 10:26 AM
  • User912338932 posted

    Regmon helped me pinpoint the case, it was the "Network Service" account that needed permissions to the registry.

    Thank you so much for the guidance, nothing could have made me happier today!
     

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Thursday, February 14, 2008 1:21 AM

All replies

  • User-823196590 posted

    http://support.microsoft.com/kb/812614

    Make sure IIS_WPG has access to C:\Program FIles\Syslog.

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Wednesday, February 13, 2008 10:26 AM
  • User1171030959 posted

    YES...

    With access defined to IIS_WPG my script work without error  :-))

    Thank you very match to your quick and efficient answer...

    Wednesday, February 13, 2008 10:59 AM
  • User912338932 posted

    Hello,

    I have a very similar situation. This command runs tru DOS window but fails via IIS 6 win 2003

        Set objWShell = CreateObject("WScript.Shell")
        Set objCmd = objWShell.Exec("c:\imail\adduser.exe -h test.com -u testuser -p sdfg")
        strPResult = objCmd.StdOut.Readall()
        set objCmd = nothing: Set objWShell = nothing 

    I have IIS_WPG, IUSR_, IWAM, System, Users with full access and propogation to the folder and just for testing even the website is running under Administrator. I started to itch and loose hair : ). It was working fine on windows 2000 IIS5

    Any ideas?

    Thanks 

     

     

    Wednesday, February 13, 2008 8:47 PM
  • User1073881637 posted

    Enable auditing of 'object failures' in the local security policy, see if anything is in Security event log.  Another couple of tools to use are Regmon and Filemon from Sysinternals.  Auditing, Regmon, Filemon can narrow down if its a obvious permissions issue.  If not, it's something in your local security policy preventing it.

    Wednesday, February 13, 2008 11:57 PM
  • User912338932 posted

    Regmon helped me pinpoint the case, it was the "Network Service" account that needed permissions to the registry.

    Thank you so much for the guidance, nothing could have made me happier today!
     

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Thursday, February 14, 2008 1:21 AM
  • User-694804488 posted

    I have kind of the same problem using HTMLDOC to create PDF files:

     

    First I have a streamwriter to C:\invoices_pdf\factuur.html (this works perfect)

    then i get permission denied on:

    Set oWSH= Server.CreateObject("WScript.Shell")
    oWSH.Run """C:\Program Files\HTMLDOC\htmldoc.exe"" --webpage -f C:\invoices_pdf\factuur.pdf C:\invoices_pdf\factuur.html", 0, True
    set oWSH = nothing

     I already tried following permissions:

     - IUSR account has full control over htmldoc.exe & invoices_pdf
    - Network service full control
    even: EVERYONE added full control

     

    also tried:
    - adding Everyone to administrators group... (lol!)

     

    didn't work either.. so I'm kinda desperate at the moment :)
     



     

    Thursday, May 15, 2008 8:20 AM
  • User-823196590 posted

    Maybe it's a registry issue like the previous poster had ...

    Thursday, May 15, 2008 8:45 AM
  • User-694804488 posted

     I don't know, I tried giving IUSR full access to my register, even that didn't work.. I'll also try with network service.. no difference..

    Thursday, May 15, 2008 6:35 PM
  • User1073881637 posted

    Did you run regmon / filemon / process monitor like I mentioned in the previous post?  Also enable your object failures local security setting, between the object failures and regmon / filemon.  You'll have an idea if there is a permissions issue. 

    Sunday, May 18, 2008 8:27 PM
  • User-630177171 posted

    Did you run regmon / filemon / process monitor like I mentioned in the previous post?  Also enable your object failures local security setting, between the object failures and regmon / filemon.  You'll have an idea if there is a permissions issue. 

     All

    I am having the same exact problem trying to run cscript.  I keep getting permission denied error 70 and do not know where to go from here.  I tried running Process Monitor but I do not fully understand what I am looking at

     This is really frustrating.  Can someone help walk me through the process?  My code is very simple


    <%@ Language=VBScript %>

    <% Option Explicit %>

    <%

    Dim WSHShell, WshEnv, sTemp

    Set WSHShell = CreateObject("WScript.Shell")

    Response.Write("Starts here<br/>")

    on error resume next

    %>

    <pre>

    <%=now()%>

    </pre>

    <%

    sTemp = "cscript"

    WSHShell.Run sTemp

    Response.write "Passed through<br/>"

    if err.number <> 0 then

    response.write "Error detected: " & err.number & ": " & err.Description & "<br/>"

    on error goto 0

    response.end

    end if

    on error goto 0

    Response.write "Run sucessfully<br/>"

    %>

    <pre>

    <%=now()%>

    </pre>

    <html xmlns="http://www.w3.org/1999/xhtml">

    <head>

    <title>jon</title>

    </head>

    <body onload="">

    <table width="100%">

    <tr><td>test</td></tr>

    </table>

    </body>

    </html>


    Thursday, July 10, 2008 11:14 AM
  • User-1000507079 posted
    I've got the same problem. My script worked for years, but when I installed a couple of security updates on the 3rd of december 2008, problems started occuring. When I restart IIS (using IISRESET), it works fine. But an or so later, it fails with a Permission Denied.

    I've shrunk my script to this, and it still fails:

    <%
        set WshShell = Server.CreateObject("WScript.Shell")
        cmd = "c:\windows\system32\cmd.exe /c dir"

        r = WshShell.Run(cmd, 0, true)
    %>

    cmd.exe has Full Control for IIS_WPG, IUSR_ and IWAM_. (And Users and Everybody :-)), but the problem still occurs.

    At some point, I thought it was related to KB957097 (NTLM Reflection Protection) because it was a known issue with the update, but disabling it and restarting the server didn't change it.

    The problem isn't limited to WshShell.Run, but also an API used for a 3rd party product.

    Any help would really be nice. :-)

    Thank you in advance.
    Christian
    Thursday, December 18, 2008 10:01 AM
  • User-2064283741 posted

    HAve you followed what Steve said?

    Enable auditing of 'object failures' in the local security policy, see if anything is in Security event log.  Another couple of tools to use are Regmon and Filemon from Sysinternals.  Auditing, Regmon, Filemon can narrow down if its a obvious permissions issue.  If not, it's something in your local security policy preventing it.

     
    Thursday, December 18, 2008 10:25 AM
  • User2104524540 posted
    how exactly you fixed IIS_WPG?

    can you explain me detail what i have to do to fix it (i got the same problem) and can't fix it.

     

    thanks.

    Thursday, June 11, 2009 4:49 AM
  • User1499377315 posted

    I know this is an old post and the poster has long since moved on, but just in case anyone else comes up with the same issue, just thought I would put in my 2 cents.  This is specifically for the htmldoc.exe poster...

     I was also getting permission denied, and had given the iusr_webfarm user full rights to everything.  And, in desperation, I gave everyone administrator rights just to see if that would eliminate the issue (it did not and of course, I promptly removed it.)  I used the methods people described above, using the security log and perfmon and found out the user not having permission was "network service", once I gave that user rights to the htmldoc folder (read and write), it started to work.

     So, thank you to everyone who wrote it, it's an old post but was still helpful to me!

    Friday, July 30, 2010 7:54 AM