StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>You might not realize it, but the actual identity running your code may not be the same as the one listed for w3wp.exe in process explorer. You should set a breakpoint or run <code>WindowsIdentity.GetCurrent().Name</code> near the offending line of code (DirectoryEntry.Parent.Children) that throws the COMException / "Access denied" violation.</p> <p>For example, for me, my App Pool process, w3wp.exe, was running as <code>NETWORK SERVICE</code> in the task manager window, as you described above as well. However, when I checked the actual runtime identity, it turned out it was the new IIS7 built-in user <code>IUSR</code>, which was different from the value I'd get in IIS6, which was <code>NETWORK SERVICE</code>.</p> <pre><code>using System.Security.Principal; Console.WriteLine( WindowsIdentity.GetCurrent().Name); // IUSR on IIS7, NETWORKSERVICE on IIS6 foreach (var de in DirectoryEntry("/LM/W3SVC/1/ROOT/MySite".Parent.Children)) { System.Console.WriteLine(de.Name); } </code></pre> <p>It seems that in IIS6, NETWORK SERVICE had permission to explore the <a href="http://www.google.com/search?q=IIS+metabase" rel="nofollow noreferrer">IIS Metabase</a> through the Active Directory Service Interface (<a href="http://msdn.microsoft.com/en-us/library/aa772170%28VS.85%29.aspx" rel="nofollow noreferrer">ADSI</a>) with the <code>DirectoryEntry</code> class. The new IUSR identity in IIS7, however, does not. In order to run the above code, you'll have to directly <a href="https://stackoverflow.com/search?q=c%23+impersonation">impersonate an account</a> with existing ADSI read privileges, for example:</p> <pre><code>using (new MyImpersonationWrapper("admin","pass")) { foreach (var de in DirectoryEntry("/LM/W3SVC/1/ROOT/MySite".Parent.Children)) { System.Console.WriteLine(de.Name); } } </code></pre> <p>Implementing your own impersonation wrapper and securing a proper local account is an exercise I'll leave to you, as your (security) needs may vary.</p> <p>Alternatively, you should be able to look up your desired information using the <a href="http://msdn.microsoft.com/en-us/library/aa347459.aspx" rel="nofollow noreferrer">WMI provider for IIS7</a> instead, as <a href="http://blogs.msdn.com/jpsanders/archive/2009/05/13/iis-7-adsi-error-system-runtime-interopservices-comexception-0x80005000-unknown-error-0x80005000.aspx" rel="nofollow noreferrer">suggested on this MSDN blog post</a>.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload