Steve
Wed Mar 28 22:45:07 CDT 2007
I can't say for sure. Usually a member server will check with the domain
for group policy refresh every 60 to 120 minutes. Some say 90 minutes, this
can vary. They *can* apply policies to override your settings. I doubt
they would on purpose, but you never know. If you see something besides
Default Domain Policy listed, it is a good chance a policy is causing the
issue. I would enable auditing to see if someone else is making changes.
Do you have any other scripts, viruses, or something else that has admin
access to change permissions. Things like robocopy jobs that would change
permissions. those are a few ideas.
--
Thank you,
Steve Schofield
Windows Server MVP - IIS
ASPInsider Member - MCP
http://www.orcsweb.com/
Managed Complex Hosting
#1 in Service and Support
"T*R*Z" <TRZ@discussions.microsoft.com> wrote in message
news:842FDA9E-C628-4567-8B83-9C0AC9575868@microsoft.com...
> Thanks a lot Steve. After running gpresult, it looks likely that we're
> getting nightly Group Policy pushes, I'll see if the network guys can help
> me
> out with this.
>
> A few more questions for you, if you don't mind:
> 1. Now that I have given IIS_WPG permissions to the proper directories, do
> I
> need to worry about the network guys overriding those permissions? (I
> suspect that before this change I had given IUSR_machinename permissions
> to
> the directories, I KNOW I never gave IIS_WPG permissions to those
> directories
> during my initial setup)
>
> 2. When I fixed this issue "the first time", I gave IIS_WPG read
> permissions
> to the c:\intepub directory (and its child directories), restarted the web
> site and all was good for the rest of that day. The following day the web
> site was broken again (that server is rebooted nightly). Ooops - my
> virtual
> directory for that app was actually on the D drive - so I gave IIS_WPG
> read
> permissions to the proper directory for that web app (on the D drive this
> time), restarted the app (touched the web.config file) and it started
> working
> again. Question: do you have any idea why, when I applied the initial fix
> to
> the c:\inetpub directory (and its children) which did NOT include the
> virtual
> directory, the app started working again? (I hadn't applied the fix to
> all
> necessary directories, but the app started working again, only to stop the
> next day)
>
> Thanks again!
>
> TRZ
>
> "Steve Schofield" wrote:
>
>> It could I guess. This points to a permissions issue more than anything.
>> Is there anything in the event log? If this machine is part of an AD
>> domain, have there been any Group Policy changes recently that would
>> affect
>> permissions? You can run gpresult at the command line to see what
>> policies are being applied. FYI..Domain polices will overrule local
>> policies. I'd not try to invent the issue, more than likely someone
>> changed
>> something and didn't communicate or document it.
>>
>> --
>>
>> Thank you,
>>
>> Steve Schofield
>> Windows Server MVP - IIS
>> ASPInsider Member - MCP
>>
>>
http://www.orcsweb.com/
>> Managed Complex Hosting
>> #1 in Service and Support
>>
>> "T*R*Z" <TRZ@discussions.microsoft.com> wrote in message
>> news:E31E69D3-99BB-4552-9BFD-73F0C324FDDF@microsoft.com...
>> >I have a Windows Server 2003, SP1 machine on which I'm hosting web
>> > applications (web pages and web services). These apps have been
>> > working
>> > fine
>> > for more than a year.
>> >
>> > As far as I know, no one in the company made any changes to this
>> > machine.
>> > We do NOT have Windows Update enabled, but 10 days ago I did download
>> > all
>> > the
>> > updates (except for SP2), installed and everything was fine .... until
>> > ....
>> > two days ago one of the web apps crashed bad. We got this:
>> >
>> > Failed to execute request because the App-Domain could not be created.
>> > Error: 0x80070005 Access is denied.
>> >
>> > After net-searching for the error, I found that I needed to give the
>> > IIS_WPG
>> > group read access to the web directories. I did this, restarted the
>> > web
>> > apps
>> > and all is good now.
>> >
>> > Here's the question: if the web apps were working just fine 3 days ago
>> > (and
>> > for a year before that), and no one made any changes to that machine,
>> > why
>> > would this problem suddenly arise two days ago?
>> >
>> >
>> > (Norton Antivirus 10 was installed on that machine 5-10 days ago, could
>> > that
>> > have caused a delayed reaction problem?)
>> >
>>
>>