·          Smooth Streaming, adaptive streaming of media over HTTP

·          Live Smooth Streaming, for live adaptive streaming of broadcast events

·          Bit Rate Throttling, meters the speed that media is delivered to a player

·          Web Playlists, secure sequencing of media content

·          Advanced Logging, with real-time client- and server-side logging

·          Application Request Routing (ARR), providing HTTP proxying and caching

You can download all of the IIS media server platform components using the Web Platform Installer button on the IIS Media page OR get the MSI package from 32Bit version / 64Bit version

I come across a requirement where one wants to automate the installation of ONLY one module (for e.g. Smooth Streaming) out of the complete IIS Media Services 3.0 package and to a customized install location (for e.g. E:\Applications\IIS Media). I did some research and here’s how we can achieve this using the Microsoft Windows Installer Tool (Msiexec.exe):

Run the command prompt as Administrator and type following command from the location where you have your MSI file located.

msiexec /i iismedia64.msi /qn /passive ADDLOCAL=feature_MediaSmooth,feature_MediaSmoothAdminUI INSTALLLOCATION="E:\Applications\IIS\Media"

where

/i      PackageName|ProductCode                Installs or configures a product

/q      n|b|r|f                                                Sets the UI level.

/passive                                                        The installer displays a progress bar

INSTALLLOCATION                                       Location where package needs to be installed

ADDLOCAL (and REMOVE)                          This pair of properties controls which software components are to be installed.  ADDLOCAL=ALL Installs   all components available in the package.

Please refer this link for more info on command line options/switches for msiexec utility.

Similarly, we ca                n use

feature_MediaPack - for the whole thing,

feature_MediaLiveStreaming - for Live Smooth Streaming while feature_MediaLiveStreamingAdminUI for Live Smooth Streaming as well as IIS manager Admin UI for component if not already installed from previous command

feature_MediaPlaylists - for Web Playlist (Corresponding Admin UI feature: feature_MediaPlaylistAdminUI)

feature_MediaBitrate - for Bitrate Throttling  (Corresponding Admin UI feature: feature_MediaBitrateAdminUI)

Hope this helps!!

Through this “Connect as” feature, one can impersonate all the users that connect to this site and send only Connect as credentials to establish a connection to the UNC path. This account can be either a domain or local account, provided the UNC share is given access (NTFS permissions) for that account.

These Connect as credentials are stored in the UNSUsername and UNCPassword IIS Metabase properties.

Now, back to our “UNC password getting blank” issue. This is a known issue with IIS manager UI and the steps which can cause this problem are:

In IIS manager, someone makes a change in the properties of that Website/Application, as a result of which it incorrectly prompts for an override (as shown below). If you click on “Select All”, this will end up setting the UNCPassword property to a blank string for any child application which is configured for UNC share and uses “Connect As” credentials.

The known properties names that will incorrectly prompt for an inheritance override and end up overriding UNCPassword too (when "Select all" is clicked in "Inheritance Override" window ) are :
-> AccessFlags (for e.g. as shown below)

-> DontLOG

-> EnableDirBrowsing

-> ContentIndexed

Hence to avoid the problem of getting UNCPassword property go blank, one should do either of below two options:

1. Do not click “Select All” "Inheritance Override" window. Click "CANCEL" if the changes made are not required to be inherited to child nodes OR "OK" if the changes made are required to be inherited to child nodes listed in the prompt

OR

2. Since this issue happens only when changes are made through IIS manager UI, make the required configuration changes to the site using either the Metabase Explorer OR the adsutil.vbs tool instead of the IIS manager UI.

Hope this helps!

The code of the ASP page looked like:
    <%
    'Use these Constants to designate the type of Event Log.
    const SUCCESS = 0
    const ERROR = 1
    const WARNING = 2
    const INFORMATION = 4
    const AUDIT_SUCCESS = 8
    const AUDIT_FAILURE = 16
    dim WshShell
    set WshShell = Server.CreateObject("WScript.Shell")
    wshshell.Logevent WARNING, "Test Event Log by Windows Script Host!"
    set wshshell=nothing
    Response.write "Event Logged Successfully by Windows Script Host!"
    %>

However by default there is limited security access rights to system event logs. Hence in order to achieve this, we need to modify a registry key which could provide required access to event logs.  Now to give the thread or lets say context identity rights to read/write the Application and/or System event log, one must modify the security of event log through the registry values under (select the event log that your application is writing to):

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\CustomSD
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\System\CustomSD

The Security Descriptor or in other words the value for the CustomSD for each log is specified by using Security Descriptor Definition Language (SDDL) syntax. Get more information on SDDL Syntax here.

By default this is the value of CustomSD key for the Application event log:
O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

To construct an SDDL string, note that there are three distinct rights that pertain to event logs: Read, Write, and Clear. These rights correspond to the following bits in the access rights field of the ACE string:
1= Read
2 = Write
4 = Clear

Entry Meaning
O:BA Object owner is Built-in Admin (BA).
G:SY Primary group is System (SY).
D: This is a DACL, rather than an audit entry or SACL.
(D;;0xf0007;;;AN) Deny Anonymous (AN) all access. (1=Read + 2=Write + 4=Clear)
(D;;0xf0007;;;BG) Deny Built-in Guests (BG) all access.
(A;;0xf0005;;;SY) Allow System Read and Clear (1=Read + 4=Clear), including DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER (indicated by the 0xf0000).
(A;;0x7;;;BA) Allow Built-in Admin READ, WRITE and CLEAR.
(A;;0x7;;;SO) Allow Server Operators READ, WRITE and CLEAR.
(A;;0x3;;;IU) Allow Interactive Users READ and WRITE.
(A;;0x3;;;SU) Allow Service accounts READ and WRITE.

- By default this is the security for the System event log:
O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;; 0x5;;;BA)(A;; 0x7;;;SO)(A;; 0x3;;;IU)(A;; 0x2;;;BA)(A;; 0x2;;;LS)(A;; 0x2;;;NS) 

Entry Meaning
O:BA Object owner is Built-in Admin (BA).
G:SY Primary group is System (SY).
D: This is a DACL, rather than an audit entry or SACL.
(D;;0xf0007;;;AN) Deny Anonymous (AN) all access.
(D;;0xf0007;;;BG) Deny Built-in Guests (BG) all access.
(A;;0xf0005;;;SY) Allow System Read and Clear, including DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER (indicated by the 0xf0000).
(A;;0x7;;;BA) Allow Built-in Admin READ, WRITE and CLEAR.
(A;;0x7;;;SO) Allow Server Operators READ, WRITE and CLEAR.
(A;;0x3;;;IU) Allow Interactive Users READ and WRITE.
(A;;0x2;;;LS) Allow Local Service WRITE.
(A;;0x2;;;NS) Allow Network Service WRITE.

Hence if your ASP page is running on Anonymous, you will have to give the IUSR or the custom Anonymous account the proper permissions on this CustomSD reg key. And if it's running on Windows Integrated, then Authenticated users group should have the required permissions.  Here's how it can be done: Append the below entry to the default value of CustomSD under the event log that you selected
For Authenticated users group (in case of windows Integrated authentication): (A;;0x0003;;;AU) where AU = Authenticated Users
For IUSR or the custom configured Anonymous account (in case of Anonymous Authentication), find the SID for that account and then create one which looks like: (A;;0x3;;;S-1-5-21-1985444312-785446638-2839930158-1121) where the last field is the SID for the IUSR account on my machine.

So conclusively, for example to give your group read permissions add the following to the CustomSD value (A;;0x1;;; [Your Group Name/user account SID]) at the end of the current string and for read and write permissions, (A;;0x3;;; [Your Group Name/user account SID])

Other related references:

How to set event log security locally or by using Group Policy in Windows Server 2003

Event Log Security

How To Log Events from Active Server Pages 

Recently I got a chance to work with a customer who was trying to deploy an ASP.NET web site using WDP (Web Deployment Project which was shipped with Visual Studio 2008 SP1). This web site had WCF (.NET 3.5) services as a part of it as well.  For deployment we were using below options in WDP -

o    "Merge all output to single Assembly" was selected

o    “Allow this precompiled site to be updatable” wasn't selected

After deploying the site we started getting below exception while trying to browse the .svc files –

Server Error in '/MyWebSite' Application.

Could not load file or assembly 'App_global.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified.

Exception Details: System.IO.FileNotFoundException: Could not load file or assembly 'App_global.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified

Assembly Load Trace: The following information can be helpful to determine why the assembly 'App_global.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' could not be loaded.

Stack Trace:

Version Information: Microsoft .NET Framework Version:2.0.50727.3053; ASP.NET Version:2.0.50727.3053

I was able to reproduce the same issue with sample application as well. After digging in further, I found that after the compilation step, WCF stores the list of referenced assemblies into the customString attribute in the build result (service.svc.cdcab7d2.compiled), including App_Global. It seems there is an incorrect assumption here that those assemblies will always be there, which is not necessarily the case in Web Deployment Projects (aspnet_merge) where assemblies will be merged. After the merge step, the assemblies are actually all merged into a single assembly (let us say MyWebSite.dll) as we selected that option in WDP. ASP.NET only updates the .compiled files it knows about, so App_Global.asax.compiled actually has a correct reference to MyWebSite_Deploy.dll instead of App_Global.dll. Original assemblies are removed after the merge step. WCF reads the list of assemblies previously stored, and throws when it cannot find App_Global.

This behavior is something which by design and getting around it there are few options as below –

1. Manually update .complied file for WCF and remove the following reference like below –

'App_global.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
'App_ GlobalResources.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
'App_ WebReferences.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
'App_ Code.asax, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null

OR

2. Add fully qualified name for the service/factory in .svc file.  The .svc buildprovider adds the list of referenced assemblies to the asp.net temporary file (as CompiledCustomString) during compilation. In the case of not-assembly-fully-qualified name is used, WCF hosting layer will use the compiled custom string to load assemblies and resolve the type of service/factory.

OR

3. In the properties of Web Deployment project, check ‘Allow this precompiled site to be updatable’ option. With this setting, the assembly App_Global.dll will not be built during the build/merge step.

OR                                                 

4. In the properties of Web Deployment project, choose merge option OTHER than “Merge All outputs to a single assembly”. The difference is that App_Global will not be merged and removed for the other options. And to get the assembly versions as needed, use compilerOptions in addition to this. Refer https://msdn.microsoft.com/en-us/library/ms228042.aspx

Hope this helps!!!