[RESOLVED] Setting up and Publishing to IIS 7.0

[Webskater]

Possibly a bit off topic ... I'm using VS2010 for the first time and will be publishing to a Windows 2008 Server with IIS 7.0 on it.

I just went into IIS 7.0 (which looks nothing like IIS 6.0 (why DO they do that?) and created a web site called 'Fred' which gets its resources from a folder on the D drive. In this case D:\WebSites\Freddy. In that folder there is one document - default.htm.

So, as I was setting the site up in IIS 7.0, I filled in the Site name, then the Physical path and clicked a button that says 'Test Settings'. When I did this it told me that Authentication was successful but that Authorization wasn't ... "Cannot verify access to path (D:\WebSites\Freddy)"

Then, if I look at the Details provided when you click on the error message it says:

"The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built-in account has access. Make sure that the application pool identity has Read access to the physical path. If this server is joined to a domain, and the application pool identity is NetworkService or LocalSystem, verify that <domain>\<computer_name>$ has Read access to the physical path. Then test these settings again."

The computer is joined to a domain and the application pool identity is NetworkService.

If I go to the directory in Windows Explorer and select Properties and then click the Security tab ... and then click Edit to add a Group, Computer or User that is to have permissions on that folder ... and add the domain/computer name so that it has read permissions on the folder ... still when I test the settings in IIS 7.0 it says the path cannot be accessed!

It's bad enough having to apparently give the computer access to a folder that is on the computer - but, even having done that, it still won't work.

What am I doing wrong? Wasted a whole afternoon on this nonsense now.

Finally, does IIS 7.0 have Front Page Server capability? Some people say it has, some people say it hasn't.

Thanks for any help.

[brin351]

I think IIS needs the computerName/users group to have permission on the folder. when I say "users" I mean that word literally. For asp.net you need to give the computerName/IIS_IUSRS group permission as well.

I'm saying this off the top of my head so double check it by all means but I think that's right.

server 2008 is different and takes a bit to get used to but it is much much better than 2003/2000.

I don't know about FP extentions

[gep13]

Hey,

If the D Drive a physical drive on the server, or is it a mapped drive?

As for Front Page Server capability, why do you want this? Are you using a legacy application? I haven't had to use this for years!

Gary

[Webskater]

Thanks for your reply.

The D Drive is a physical drive on the computer.

As for FrontPage Server Extensions - I'm publishing to http://someappname/thatappsvirtualdirectory - and if I've tried to publish like that to a web that has not had the FrontPage Server Extensions enabled - VS throws up a 'the web site has not got the FrontPage Server Extensions installed' message.

[gep13]

Ah, I see what you mean.

I normally always use FTP to publish sites to IIS, so in all honesty, I am not sure what options you have here.

Since it is a physical drive, I can't think of a reason why the network service user doesn't have permissions already to the folder, but it is still worth checking the exact permissions that have been assigned to the folder.

Gary

[Webskater]

Ah, I see what you mean.

I normally always use FTP to publish sites to IIS, so in all honesty, I am not sure what options you have here.

I work on my own, from home, in complete isolation from the IT world, as it were. So, I pick things up as I go along. When I first started using Visual Studio and .Net (a few years ago) someone told me something like 'the big advantage of .Net is that, when you publish a web site, the site is compiled to a dll and runs much more quickly than uncompiled code.' So, every site I have created, I publish like that. The worry about is that if you have a problem on a live site, you have to re-publish, you can't just tinker with the one page that has fallen over. And, you have to be serious about version control etc.

When you FTP your sites to an IIS server are you transferring a compiled file - i.e. the dll - or do you transfer all the files so the site is not compiled? Can you ftp a compiled site?

Thanks again for your replies.

[brin351]

I use FTP to - filezilla - it's free. You can set your publish option to be "make website updatable" and use "fixed naming" . So you can publish to a local folder and ftp accross only the page/dll that changed.

Did you resolve the permissions problem?

[Webskater]

Did you resolve the permissions problem?

No, it's driving me nuts. The folder has permissions for ...

CREATOR OWNER
SYSTEM
Network\NameOfComputer$
NameOfComputer\Adminstrators
NameOfComputer\Users
NETWORK
NETWORK SERVICE

... which exactly the same as is in use on a Windows 2003 Server running IIS 6.0 - which I have no problems with.

[gep13]

When you FTP your sites to an IIS server are you transferring a compiled file - i.e. the dll - or do you transfer all the files so the site is not compiled? Can you ftp a compiled site?

Thanks again for your replies.

Yip, what I typically do is "publish" to a local folder on my hard drive. i.e. compile the code into DLL's, etc. Then, I FTP the "published" site up onto the server.

Like brin, I also use FileZilla. It is very good at what it does.

Gary

[brin351]

No, it's driving me nuts. The folder has permissions for ...

CREATOR OWNER
SYSTEM
Network\NameOfComputer$
NameOfComputer\Adminstrators
NameOfComputer\Users
NETWORK
NETWORK SERVICE

... which exactly the same as is in use on a Windows 2003 Server running IIS 6.0 - which I have no problems with.

I setup a test website on my dev machine and looked at a production server (both win server 2008) and both show the same message you are getting as follows

clicked a button that says 'Test Settings'. When I did this it told me that Authentication was successful but that Authorization wasn't ... "Cannot verify access to path (D:\WebSites\Freddy)"

both websites are served (to a browser) correctly so I think it's just a warning message saying "IIS manager" can not verify all the permissions you may need. I googled it but got no diffinitive answer. Try browsing the website and see if it works. BTW the only permissions I give besides ADIM, SYSTEM are computer/Users and computer/IIS_IUSRS.

Also this link on setting up permissions might interest you

http://learn.iis.net/page.aspx/194/c...s-permissions/

[sapator]

Reading about website compilation, may i ask if it really boosts performance?
I've read this http://www.asp.net/hosting/tutorials...our-website-vb
but it just says how to do it not why to do it.So why must someone compile the site?

[Webskater]

I setup a test website on my dev machine and looked at a production server (both win server 2008) and both show the same message you are getting as follows



both websites are served (to a browser) correctly so I think it's just a warning message saying "IIS manager" can not verify all the permissions you may need. I googled it but got no diffinitive answer. Try browsing the website and see if it works. BTW the only permissions I give besides ADIM, SYSTEM are computer/Users and computer/IIS_IUSRS.

Also this link on setting up permissions might interest you

http://learn.iis.net/page.aspx/194/c...s-permissions/

Thanks again for your help. As luck would have it, someone rang me yesterday that I haven't spoken to for a long time - and he is a network consultant. I explained the problem to him and he said 'in Windows Server 2008 / IIS 7.0 - everything runs under 'NETWORK SERVICE'. I had found this out myself so, while he was on the phone, I re-checked the permissions. I hadn't given 'NETWORK SERVICE' permissions on the root - but I had for folders above (or below depending on how you look at it).

I changed the permissions on the root - and the site became browseable. But, when I went (in IIS) to the virtual directories for the web sites below the root - and clicked on 'Basic Settings' and then 'Test Settings' - the 'Authorization failed' message still appeared. I said to the network consultant 'but the authorization failed message is still there' and he said 'oh I've never managed to get that to go away'.

I had got myself into a loop of ... changing permissions ... testing .. being told Authorisation had failed ... changing permissions ... testing .. being told Authorisation had failed ... etc. etc. when, all the time, the issue was not that 'Authorisation had failed' - it was that I hadn't given 'NETWORK SERVICE' permissions on the root.

Back to 'Zen and the Art of Motorcycle Maintenance' for me I think!

Finally, to wrap this up as it were, as I'm on an intranet I gave up wondering whether IIS 7.0 has FrontPage Server extensions capability - and just published to the file path. I wasn't sure if this would mean that IIS would automatically create a virtual directory for the site and give it permissions automatically etc. - but it did.

Thanks again to all for help.

[brin351]

From what I understand each site in IIS7 has it's own app_pool and NETWORK SERVICE group is automatically assigned to it. I'm no expert on win server so I'll shut up now and say glad to hear it's working.

[Webskater]

From what I understand each site in IIS7 has it's own app_pool and NETWORK SERVICE group is automatically assigned to it. I'm no expert on win server so I'll shut up now and say glad to hear it's working.

Yes, that is true from what I can see. Whenever you create a new site, it creates an app-pool for that site and the Identity is NETWORK SERVICE. What I wasn't doing was assigning NETWORK SERVICE to have permissions to the physical root folder.

Cheers.