Remove From My Forums

Debugging asp.net application on local IIS server without admin privileges

Question
0

Sign in to vote

We have a .net department developing websites and applications for IIS servers. Currently, debugging is done by each developer on a local IIS server, using VS2010/VS2012.

Attaching the VS debugger to w3wp process requires local administrator rights. For obvious reasons, we do not want our developers to hold admin privileges. We have considered the following solutions:

1. Running the website on IIS express. this does not help us, since we need to be sure rolling updates will behave on client's server the exact same way they behave on the developer computer

2. Running IIS and the IIS manager under user privileges instead of as a system service. I could not find a way to do it, in a way that allows users to manage the websites and applications

3. Giving developers debug permissions. I'm aware of the risks, but willing to take them. Giving developers local "Debug programs" policy should let them attach VS debugger to system process, However I get "Visual Studio has insufficient privileges to inspect the process's identity" even with "Debug programs" allowed and the user in the local IIS_IUSERS. I can, however, attach to w3wp process with windbg.

The question:
1. What are the minimum privileges needed for VS2010 to be able to attach to w3wp.exe?
2. what are the minimum privileges a user needs to be able to manage local IIS?
3. Is there another way to debug the asp.net app WITHOUT changing our whole DevOps workflow?

Thank you all

Tuesday, May 3, 2016 1:52 PM

Answers

0

Sign in to vote
Hi davidb_codeoasis,

Since one thread for one issue, if possible, I suggest you open new threads for different issue.

>>1. What are the minimum privileges needed for VS2010 to be able to attach to w3wp.exe?

By default, the ASP.NET worker process runs as an ASPNET user process. As a result, we must have Administrator privileges on the computer where ASP.NET runs to debug it.

Reference:

https://msdn.microsoft.com/en-us/library/3s68z0b3.aspx

>>2. what are the minimum privileges a user needs to be able to manage local IIS?

For the local IIS issue, I suggest you discuss this issue with the IIS Team experts here:

https://forums.iis.net/

You could also get some useful information here:

Reference:

https://msdn.microsoft.com/en-us/library/58wxa9w5(v=vs.120).aspx#iisdisadvantages

>>3. Is there another way to debug the asp.net app WITHOUT changing our whole DevOps workflow?

For this issue, as far as I know, we often debug the web app using the IIS or remote debugging tool, not very sure that whether certain way is what you want to use.

Remote debugging:

https://msdn.microsoft.com/en-us/library/mt621540.aspx?f=255&MSPPError=-2147217396

Best Regards,

Jack
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click HERE to participate the survey.
- Proposed as answer by Jack Zhai-MSFTMicrosoft contingent staff Tuesday, May 10, 2016 4:54 PM
- Marked as answer by Jack Zhai-MSFTMicrosoft contingent staff Thursday, May 12, 2016 4:48 PM
Friday, May 6, 2016 9:42 AM

Answered by:

Debugging asp.net application on local IIS server without admin privileges

Question

Answers