IIS won't look where I'm pointing. Is it dumb? Or is it just me?

I'm an IIS newbie so please bear with me...

We are migrating a currently working, .NET web app to a new server (both
2003 Svr). One of the application pages uses an IFrame to host legacy asp
pages. The IFrame points to a folder in inetpub. On the old server, inetpub
resided on the c: drive and the legacy folder was not a virtual directory.

On the new system, we have set up an inetpub on d: and the folder resides
there. Everything works fine except that the IFrame absolutely will not see
files in that folder. I have tried it as a virtual directory. I have even
tried moving the folder to inetpub on the c: drive; but to no avail.

I've checked everything from odbc connections to sql aliases. Can anyone
suggest things for me to check/look into?
--
Thanks,

CGW

DaveK
Tue Mar 14 12:58:27 CST 2006

Enable failure auditing for all local drives. Right click on the drive, click
on properties, click on security, then advanced, then auditing. Add
"everyone" and then select all the boxes under "failed". In the local
security policy enable failure auditing. You can now look in the security
eventlog to see if the IUSR or some other account does not have access to a
folder. If that doesn't solve your problem check your IIS logs for errors.
You can also track the HTTP conversation with this tool
http://www.fiddlertool.com

Kristofer
Tue Mar 14 14:32:12 CST 2006

Is the URI correct? What is reported in the IIS log file (status code,
substatus code and scwin32 status code)?


--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


CGW wrote:

>I'm an IIS newbie so please bear with me...
>
>We are migrating a currently working, .NET web app to a new server (both
>2003 Svr). One of the application pages uses an IFrame to host legacy asp
>pages. The IFrame points to a folder in inetpub. On the old server, inetpub
>resided on the c: drive and the legacy folder was not a virtual directory.
>
>On the new system, we have set up an inetpub on d: and the folder resides
>there. Everything works fine except that the IFrame absolutely will not see
>files in that folder. I have tried it as a virtual directory. I have even
>tried moving the folder to inetpub on the c: drive; but to no avail.
>
>I've checked everything from odbc connections to sql aliases. Can anyone
>suggest things for me to check/look into?

CGW
Tue Mar 14 16:12:27 CST 2006

Thank you. All those suggestions were great, and it's like Christmas playing
with the new toys (there were a couple of others at the fiddler site).
However, the server is stand alone right now and I wasn't too sure how to
enable failure logging. I did use the event viewer, but nothing to report
there. I reviewed the IIS logs once more and compared them with successful
execution on the original server. The calls are exactly the same except that
the one on the new server fails.

The only difference I can see is that Crystal 10 created an application pool
with the same name as the folder ("Web"), and yet, I can't find where any of
the crystal virtual directories have co-opted the name.

I'll keep looking. Thank you for the great help!
--
Thanks,

CGW


"DaveK" wrote:

> Enable failure auditing for all local drives. Right click on the drive, click
> on properties, click on security, then advanced, then auditing. Add
> "everyone" and then select all the boxes under "failed". In the local
> security policy enable failure auditing. You can now look in the security
> eventlog to see if the IUSR or some other account does not have access to a
> folder. If that doesn't solve your problem check your IIS logs for errors.
> You can also track the HTTP conversation with this tool
> http://www.fiddlertool.com
>
>

CGW
Tue Mar 14 16:26:30 CST 2006

I really, really wish I could say that I understand what the status code,
substatus code, and scwin32 were trying to tell me. I'm including four lines
from the log which reflect two failures. (I've clipped off the first half of
the IP addresses).

2006-03-14 21:27:22 W3SVC1 1.12 GET /web/legapp/step1_repostand.asp - 80 -
5.32
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 404 2 1260
2006-03-14 21:27:23 W3SVC1 1.12 GET /oursite/iConnector.aspx
ref=8&AppID=7&res=true&sHeight=748 80 - 5.32
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 302 0 0
2006-03-14 21:27:24 W3SVC1 1.12 GET /web/legapp/step1_repostand.asp - 80 -
5.32
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 404 2 1260
2006-03-14 21:27:24 W3SVC1 1.12 GET /oursite/iConnector.aspx
ref=8&AppID=7&res=true&sHeight=748 80 - 5.32
Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 302 0 0

Is that helpful?
--
Thanks,

CGW


"Kristofer Gafvert" wrote:

> Is the URI correct? What is reported in the IIS log file (status code,
> substatus code and scwin32 status code)?
>
>
> --
> Regards,
> Kristofer Gafvert
> http://www.gafvert.info/iis/ - IIS Related Info
>
>
> CGW wrote:
>
> >I'm an IIS newbie so please bear with me...
> >
> >We are migrating a currently working, .NET web app to a new server (both
> >2003 Svr). One of the application pages uses an IFrame to host legacy asp
> >pages. The IFrame points to a folder in inetpub. On the old server, inetpub
> >resided on the c: drive and the legacy folder was not a virtual directory.
> >
> >On the new system, we have set up an inetpub on d: and the folder resides
> >there. Everything works fine except that the IFrame absolutely will not see
> >files in that folder. I have tried it as a virtual directory. I have even
> >tried moving the folder to inetpub on the c: drive; but to no avail.
> >
> >I've checked everything from odbc connections to sql aliases. Can anyone
> >suggest things for me to check/look into?
>

Kristofer
Tue Mar 14 16:39:13 CST 2006

404 is the status code, which means that the file was not found.
2 is the substatus code indicating that the request was denied due to
Lockdown Policy.
The meaning of scwin32 status code is found by using net helpmsg:

C:\Documents and Settings\kristofer>net helpmsg 1260

Windows cannot open this program because it has been prevented by a
software res
triction policy. For more information, open Event Viewer or contact your
system
administrator.

So to solve your problem, you need to allow the ASP Web Service Extension.
How to do this is explained here:

http://www.gafvert.info/notes/ASP404NotFound.htm

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


CGW wrote:

>I really, really wish I could say that I understand what the status code,
>substatus code, and scwin32 were trying to tell me. I'm including four
>lines
>from the log which reflect two failures. (I've clipped off the first half
>of
>the IP addresses).
>
>2006-03-14 21:27:22 W3SVC1 1.12 GET /web/legapp/step1_repostand.asp - 80 -
>5.32
>Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
>404 2 1260
>2006-03-14 21:27:23 W3SVC1 1.12 GET /oursite/iConnector.aspx
>ref=8&AppID=7&res=true&sHeight=748 80 - 5.32
>Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
>302 0 0
>2006-03-14 21:27:24 W3SVC1 1.12 GET /web/legapp/step1_repostand.asp - 80 -
>5.32
>Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
>404 2 1260
>2006-03-14 21:27:24 W3SVC1 1.12 GET /oursite/iConnector.aspx
>ref=8&AppID=7&res=true&sHeight=748 80 - 5.32
>Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
>302 0 0
>
>Is that helpful?

CGW
Tue Mar 14 17:00:12 CST 2006

Wow! and Thanks!
--
Thanks,

CGW


"Kristofer Gafvert" wrote:

> 404 is the status code, which means that the file was not found.
> 2 is the substatus code indicating that the request was denied due to
> Lockdown Policy.
> The meaning of scwin32 status code is found by using net helpmsg:
>
> C:\Documents and Settings\kristofer>net helpmsg 1260
>
> Windows cannot open this program because it has been prevented by a
> software res
> triction policy. For more information, open Event Viewer or contact your
> system
> administrator.
>
> So to solve your problem, you need to allow the ASP Web Service Extension.
> How to do this is explained here:
>
> http://www.gafvert.info/notes/ASP404NotFound.htm
>
> --
> Regards,
> Kristofer Gafvert
> http://www.gafvert.info/iis/ - IIS Related Info
>
>
> CGW wrote:
>
> >I really, really wish I could say that I understand what the status code,
> >substatus code, and scwin32 were trying to tell me. I'm including four
> >lines
> >from the log which reflect two failures. (I've clipped off the first half
> >of
> >the IP addresses).
> >
> >2006-03-14 21:27:22 W3SVC1 1.12 GET /web/legapp/step1_repostand.asp - 80 -
> >5.32
> >Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> >404 2 1260
> >2006-03-14 21:27:23 W3SVC1 1.12 GET /oursite/iConnector.aspx
> >ref=8&AppID=7&res=true&sHeight=748 80 - 5.32
> >Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> >302 0 0
> >2006-03-14 21:27:24 W3SVC1 1.12 GET /web/legapp/step1_repostand.asp - 80 -
> >5.32
> >Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> >404 2 1260
> >2006-03-14 21:27:24 W3SVC1 1.12 GET /oursite/iConnector.aspx
> >ref=8&AppID=7&res=true&sHeight=748 80 - 5.32
> >Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+Maxthon;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727)
> >302 0 0
> >
> >Is that helpful?
>

David
Tue Mar 14 17:21:21 CST 2006

And the reason this security 404 returns the same thing as a generic 404 (so
it looks like "IIS won't look where I'm point") is also for security
reasons.

If IIS returns the same 404 when it blocks .asp from executing as well as
file-not-found, hacker cannot distinguish between the two.

If IIS returns different 404 when it blocks .asp from executing and from
file-not-found, hacker knows ASP is there but not enabled.

In general, you want to troubleshoot a server with its log files and not the
quality of the responses it sends back because log file is unfiltered,
absolute data while responses are always relative to some security
configuration/interpretation. You want to troubleshoot with unfiltered, real
data instead of relative ones.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

"CGW" <CGW@discussions.microsoft.com> wrote in message
news:3B01FDE9-DC20-404D-994F-29D31744D79D@microsoft.com...
> Wow! and Thanks!
> --
> Thanks,
>
> CGW
>
>
> "Kristofer Gafvert" wrote:
>