I recently encountered the error “The path is not of a legal form.” from the IIS 7.0 Manager, but was unable to find any documentation on the error.  Oddly this error didn’t log anything in the System Event Log either. 

The error sounds like a config issue so I focused on web.config and applicationHost.config.

Problem:

When expanding a website in the IIS Manager we get the error below.  This happens only for one specific web site, other sites are on the server are fine.  Additionally the problematic site continues to serve out pages without error.  The only real problem here is an inability to administer the web site.

Error:

Internet Information Services (IIS) Manager
The path is not of a legal form.

Screenshot:

Cause:

After inspecting applicationHost.config I noted that one application didn’t have a physical path specified.

<application path="/appdir" applicationPool="DefaultAppPool">
       <virtualDirectory path="/" physicalPath="" />
</application>

Notes:

This is a situation that we should never find ourselves in, unfortunately we did.  The IIS manager wouldn’t let us make this kind of configuration setting, the physicalPath is required.  In our case we got here by a third party application installation failure.

After noting the config error in the applicationHost.config we also determined that the problem was detectable in the IIS Manager itself by viewing the applications in the application pool.

Once we were viewing the various applications in the application pool it was obvious that there was one application which had it’s Physical path set to blank.

Solution:

All Applications must have a valid physical path.

Here is the set up, I have a very simple global.asa file which increments SessionCount in Session_OnStart and decrements SessionCount in Session_OnEnd:

and a very simple asp page which reports the value of SessionCount.

Seems simple enough right?

Well it is, and on IIS 5.0 and IIS 6.0 this simple set up works just as expected.  However, on IIS 7.0 the session count never decrements.

To allow Session_OnEnd to execute correctly we need to set RunOnEndAnonymously=False.  To set this value we just need to run this command:

Once this change is made the applicationhost.config should have the following entry:

After this the Session_OnEnd event should fire and run successfully. 

NOTE: We could also use adsutil.vbs to make the needed change. IIS 6.0 Management Compatibility Role Service will need to be installed.  Once it is installed we need to run this command to make the needed change:

Problem Description

When trying to configure an Application Pool for a web site or web Application you see <Invalid Application Pool> in the Application Pool field on the Home Directory tab of the properties of the Site or Virtual directory. There may be other application pools to select or there may not.

There are no errors in the system event log.

Cause

This problem occurs when the KeyType element is missing or contains an invalid
string. A list of possible values for this element is available in MSDN.

Resolution

Method #1

Use adsutil.vbs to identify the Application pool which does not show up in the MMC

Enumerate the application pools:

C:\Inetpub\AdminScripts>adsutil.vbs enum /p w3svc/apppools [/w3svc/apppools/DefaultAppPool] [/w3svc/apppools/ASP.NET 1.1] [/w3svc/apppools/ASP.NET 2.0] [/w3svc/apppools/Broken App Pool] [/w3svc/apppools/Kerberos] C:\Inetpub\AdminScripts>

Then get each app pool keytype, we are looking for one which either returns "The Parameter 'keytype' is not set at this node" or returns a string which is NOT "IIsApplicationPool"

C:\Inetpub\AdminScripts>adsutil.vbs get "w3svc/apppools/Broken App Pool/keytype" keytype             : (STRING) "IIsApplicationPoolNOT" C:\Inetpub\AdminScripts>

Once you have identified the invalid application pool you need to correct or add the value for keytype.

C:\Inetpub\AdminScripts>adsutil.vbs set "w3svc/apppools/Broken App Pool/keytype" IIsApplicationPool keytype              : (STRING) "IIsApplicationPool" C:\Inetpub\AdminScripts>

Method #2

You can also use Metabase Explorer to correct this issue. Metabase Explorer is part of the IIS Resource Kit Tools.

1. Open MB Explorer.
2. Expand LM>W3SVC>AppPools.
   
3. Look for application pool which does not show up in IIS MMC or one missing or with an invalid string value. The only valid value at this location is "IIsApplicationPool".
   
4. Add a Record called "KeyType" with a value of "IIsApplicationPool".
   
5. Close Metabase Explorer.
6. Open IIS MMC and should be able to change application pool on web site/virtual directory now.

To assign the existing private key to a new certificate, you must use the Microsoft Windows Server 2003 version of Certutil.exe. To do this, follow these steps:

1.	Log on to the computer that issued the certificate request by using an account that has administrative permissions.
2.	Click Start, click Run, type mmc, and then click OK.
3.	On the File menu, click Add/Remove Snap-in.
4.	In the Add/Remove Snap-in dialog box, click Add.
5.	Click Certificates, and then click Add.
6.	In the Certificates snap-in dialog box, click Computer account, and then click Next.
7.	In the Select Computer dialog box, click Local computer: (the computer this console is running on), and then click Finish.
8.	Click Close, and then click OK.
9.	In the Certificates snap-in, expand Certificates, right-click the Personal folder, point to All Tasks, and then click Import.
10.	On the Welcome to the Certificate Import Wizard page, click Next.
11.	On the File to Import page, click Browse.
12.	In the Open dialog box, click the new certificate, click Open, and then click Next.
13.	On the Certificate Store page, click Place all certificates in the following store, and then click Browse.
14.	In the Select Certificate Store dialog box, click Personal, click OK, click Next, and then click Finish.
15.	In the Certificates snap-in, double-click the imported certificate that is in the Personal folder.
16.	In the Certificate dialog box, click the Details tab.
17.	Click Serial Number in the Field column of the Details tab, highlight the serial number, and then write down the serial number.
18.	Click Start, click Run, type cmd, and then click OK.
19.	At the command prompt, type the following: certutil -repairstore my "SerialNumber" SerialNumber is the serial number that you wrote down in step 17.
20.	In the Certificates snap-in, right-click Certificates, and then click Refresh. The certificate now has an associated private key.

You can now use the IIS MMC to assign the recovered keyset (certificate) to the Web site that you want.