In IIS 7+ we have changed the feature of allowing PUT, MKCOL, PROPPATCH, COPY, MOVE, and DELETE to require authentication. Anonymous PROPFINDs are allowed for file listings, but others require the request be authenticated. This was done as a security measure. In IIS 6.0 we did have the provision of using the above methods using anonymous requests from the clients but not anymore. I think the reason people still want this feature in IIS 7 is because of some 3^rd party applications like CURL etc which send Anonymous PUT requests to a WebDAV site.

Lot of people who have migrated from IIS 6.0 to IIS 7+ still request for this functionality. Please note that this is neither recommended nor supported by Microsoft Product Support Services (PSS).

Here, however I will show you a method of achieving a similar feature without users requiring to send user credentials for WebDAV requests. Basically the WebDAV module checks whether the request is authenticated or not. If not (i.e. using Anonymous authentication) WebDAV module will respond saying “Anonymous access not allowed” in the FREB logs.

There is a KB article which talks about this as well http://support.microsoft.com/kb/2021641/en-us

So one way of hacking this is to convince WebDAV module that your request is authenticated. So before the WebDAV module gets a chance to handle the request ensure we change the identity context as an authenticated user. In IIS 7 we can write a native ISAPI filter (preferred for performance reasons) or a managed HTTP Module which can intercept the request and change the user context to some pre-configured windows identity. Or else you can read a username/password from a configuration file (or hard code the vale) and then create a basic Base64 hash for the combination and add it to the Request header collection. This in my opinion is a neater way than the first method.

Here are the steps for injecting Basic Base64 hash in the Request header collection:

• Create a custom HTTP Module (attached with the post) and on Application_BeginRequest read the username/password (either a local or a domain user credential, your choice). Here in the sample I have hardcoded these values but you can read it from a configuration file or by some other means. After we have the username and the password, we concatenate the strings separated by a colon (:), and then compute the Base64 hash for this string and then add a custom HTTP header (“Authorization”) to the incoming request with this Base64 value. The processing in the remaining pipeline thinks that the end user has sent a Basic authentication credential whereas our module is adding this in the BeginRequest event.
• Compile the Http Module and copy the dll in to the bin folder under your WebDAV site in IIs 7.
• Ensure that the custom HTTP Module is invoked before the WebDAV module. WebDAV module thinks that the request is authenticated and hence allows operations like PUT/DELETE etc.
• In the Web.config file under your WebDAV site, add the following:

<modules runManagedModulesForWebDavRequests="true">

<add name="CustomBasicWebDAVModule" type="CustomBasicWebDAVModule"/>

</modules>

• Ensure that we have added the following attribute runManagedModulesForWebDavRequests="true" to the Modules section as shown above.
• Last but not least enable only Basic authentication for your WebDAV site (Don’t worry user/client won’t be required to pass in any credentials).

Now go ahead and you should be able to use PUT/DELETE etc verbs for the WebDAV requests for this site anonymously (well, not technically correct though).

Thanks to Robert for the valuable suggestion on this forum and the inputs.

**PLEASE NOTE THAT THIS IS NEITHER RECOMMENDED NOR SUPPORTED BY MICROSOFT PSS. USE IT WITH CAUTION.

HTTP Module class.txt

http://support.microsoft.com/kb/2434810

If you would like PSS to write on more topics that may interest you please put up your suggestions.

HTH

When does IIS kick off a new download of a CRL? Does it look at the Next Update field within the CRL and then keep a log (somewhere on IIS or registry) on when it requires to download the next CRL from the CA?

==>

To answer the above question in specific it depends upon various settings/scenarios as described below.

IIS by default looks into the downloaded CRL for the next update field. This is stored in its own memory cache and also physically in the server under either

%windir%\System32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData (on Win2k3 server), or

%windir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData (on Win2k8)

You can find the cached CRLs using this command as well Certutil –urlcache CRL at a command-line prompt.

If the current date is well behind the ‘Next Update’ field value it will use the current CRL to validate the client certificates.

CRL verification depends upon the metabase properties (IIS 6.0) like CertCheckMode, RevocationFreshnessTime and RevocationURLRetrievalTimeout.

1. If CertCheckMode is set to 0, IIS does the CRL verification based on the cached CRL on the server (based on its properties like current date and ‘Next Update’ field).

If the current date is in the range of ‘Effective Date’ and ‘Next Update’ fields it will use the local CRL cache. If the current date is beyond ‘Next Update’ field it will try downloading the CRL from the remote location and use it.

2. If CertCheckMode is set to 1 Certificate revocation checking is not performed.

3. If CertCheckMode is set to 2 Certificate revocation verification will be done based on the cached CRL on the IIS server. IIS will not try to connect to the remote server to download the CRL even if it has expired and in which case CRL verification will obviously fail.

4. If CertCheckMode is set to 4 Certificate revocation verification will be done by downloading the remote CRL, even if we have the valid cached CRL on the server. It ignores the cached CRL completely.

The frequency with which we download the remote CRL depends upon the value of the metabase property called RevocationFreshnessTime.

If this property is set to 1 (true) then the CRL on the server is updated from the remote location (even though local cached CRL is valid) every 1 day by default. If the metabase property RevocationFreshnessTime is set to a higher value (instead of 1) IIS uses its value directly to look for the frequency with which CRL is updated. Remember the value defines the time interval in seconds.

This default timeout interval for updating the CRL is controlled by another metabase property called RevocationURLRetrievalTimeout. This defines the timeout interval in milliseconds. You can increase this value if you think there might be some latency in downloading the CRL from the remote server.

          When you are dealing with the 4th option above ensure you check this link in case you are getting this same issue.      

Hopefully the above explanation gives you an idea as to how and when IIS asks the Crypto subsystem to retrieve a copy of the CRL. This is finally done by Schannel during TLS negotiation.

In IIS 7+ you can use netsh commands to set different values for CRL verification (Equivalent to setting CertCheckMode in IIS 6.0). Refer to this and this for details.

Ciao

For more details on how FREB works here is a good link.

However you may notice that based on the rule that you configure with FREB you may end up with lot many log files that are generated by the FREB module. It again depends upon the number of requests hitting your website and how many of them fall under one of the rules that you have configured. The pain starts when you navigate to the folder where you have all these log files. The default location is %systemdrive%\inetpub\logs\FailedReqLogFiles\. If you have lot of log files created you may see them listed as below:

Looking at the above screenshot we know that the file names are not descriptive enough to help us distinguish which file corresponds to which request/property. It may be a little painful to go through all of them just to find the right one. Imagine 100+ files in the folder!

I have developed a simple application which asks you for the location where you have the FREB logs and then creates a copy of all the logs in a subfolder with more descriptive names. These names are actually based on the request properties associated with that log file like time-stamp, page name, verb, status code, time-taken etc.

After you run the tool it creates a subfolder named “NewFREBLogs” under the folder you selected above. It doesn’t modify or delete the existing FREB logs anyway.

The new file names will be more descriptive as shown below.

Hope this saves some time while rummaging through all the logs.

You can download it from the following link

http://www.iis.net/community/default.aspx?tabid=34&g=6&i=2011

Till next time…Cheers to life!

“The Page cannot be displayed”

This can happen for websites that use TLS security protocol for encryption.

If you are experiencing this behaviour please check the following support KB for more information.

http://support.microsoft.com/kb/2384778

“Invalid syntax” or error code 800401E4

Or

Microsoft VBScript runtime error: The remote server machine does not exist or is unavailable: 'GetObject'

In my script I was using the following

GetObject( "IIS://" & ServerName & "/W3SVC" )

So basically the above error was complaining about the use of GetObject.

Resolution

1. Ensure Firewall is not blocking access to your server from remote access on the client.

2. ADSI provider should be installed on the client as well as the IIS machine for the above script to work. For running ADSI script against IIS we need to ensure the ADSI provider is installed as below.

Windows Server 2003/XP:

Add/Remove windows Components –> Application Server –> Internet Information services (IIS) –> Common Files.

Windows Vista/Windows 7:

Control Panel –> Programs and Features –> Turn Windows Features on or off –>  Internet Information Services –> Web Management tools –> IIS 6 Management Compatibility –> IIS Metabase and IIS 6 configuration compatibility

Windows Server 2008:

Server Manager –> Roles –> web Server (IIS) –> Add Role Services  –> Management Tools –> IIS 6 Management Compatibility –> Select IIS 6 Metabase compatibility, IIS 6 WMI compatibility and IIS 6 Scripting Tools.

Hoping It may help someone who might be struggling with trying to run the script remotely.

Ciao!

<configuration>
  <system.diagnostics>
    <assert assertuienabled="true" logfilename="c:\\myFile.log" />
  </system.diagnostics>
</configuration>

You can also get the output of Debug.Assert (..) in the Output window within Visual Studio. It will also be logged in the System event log. However, this seems to work with the earlier version of IIS, i.e. IIS 6.0 in the console session.

After going through various forums I see that developers do complain about this being a deprecated feature in IIS 7+ versions which hampers debugging.

However In my opinion it should *never* have worked in the first place for any service based application. ASP.Net application runs as a service on the server side and it should never launch an interactive window which might lead to the process getting into a hung state for all the clients. Lot of times developers miss deleting one of these entries from their code before moving it to the production environment and that leads to hang/frozen condition for the application for all the end users. This is not specific to IIS or ASP.Net in my opinion but manifestation of a feature from Vista onwards at the OS level. Session 0 isolation in Vista onwards prevents services from interacting with user sessions in the way it was possible in the previous versions of Windows like Windows Server 2003.

http://www.microsoft.com/whdc/system/sysinternals/Session0Changes.mspx

https://channel9.msdn.com/posts/Charles/Session-0-Changes-and-Vista-Compatibility-for-Services-running-as-Interactive-with-Desktop/

Important  All services run in Terminal Services session 0 from Vista onwards. Therefore, if an interactive service displays a user interface, it is visible only to the user who is connected to session 0. Applications running in other sessions cannot access Session 0 GUIs. Because there is no way to guarantee that the interactive user is connected to session 0, do not configure a service to run as an interactive service under Terminal Services or on a system that supports fast user switching.

HTH

Saurabh

Professional Advisory Services is an hourly, fee-based, consultative support option that provides proactive support beyond break-fix product support needs. Typical Advisory Services cases involve providing recommendations or best practices to solve problems leveraging Microsoft Products and Technologies. These scenarios include topics such as migration, product customization, performance degradation analysis, deployment training, scaling infrastructure, server recovery, optimization, supportability, risk analysis, root cause analysis, extensibility, architecture, and knowledge transfer.

If you are a Developer/Administrator and looking for consulting/advisory services from Microsoft here is the link you can follow and see what all products/technologies are covered and other details.

http://support.microsoft.com/gp/advisoryservice#tab7

HTH

Saurabh

• IIS application pools or websites no longer starts.
• IIS web-sites may not be able to start.
• Rapid Fail Protection shuts down your application pools.
• An inspection of the event logs show that the IIS worker processes are terminating unexpectedly, showing event messages similar to the following:

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1009
Date:  12/9/2009
Time:  10:55:01 AM
User:  N/A
Computer: WEBSERVER01
Description:
A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '1234'.
The process exit code was '0xffffffff'.

Please go ahead and reapply Windows Server 2003 Service Pack 2 to resolve this issue.

For more details visit the following link.