Until then...bye...

In event logs found the following entry with different package name.

Log Name:      System
Source:        Microsoft-Windows-Servicing
Date:          10/26/2009 4:29:05 PM
Event ID:      4375
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:     <Computer Name>
Description:
Windows Servicing failed to complete the process of setting package WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~~7.2.6001.788 () into Installed(Installed) state
Event Xml:
<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{bd13f3b8-fc40-4a61-a307-b7a013a069c1}" EventSourceName="Microsoft-Windows-Servicing" />
    <EventID Qualifiers="49152">4375</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-10-26T20:29:05.000Z" />
    <EventRecordID>175445</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer><ComputerName></Computer>
    <Security />
  </System>
  <UserData>
    <CbsPackageChangeState xmlns="https://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~~7.2.6001.788</PackageIdentifier>
      <ReleaseType>
      </ReleaseType>
      <PackageState>Installed</PackageState>
      <PackageAssembly>WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~~7.2.6001.788</PackageAssembly>
      <Operation>Installed</Operation>
      <OperationCompleted>True</OperationCompleted>
      <ErrorCode>0x800f0826</ErrorCode>
      <RebootOption>False</RebootOption>
      <MissingElements>
      </MissingElements>
    </CbsPackageChangeState>
  </UserData>
</Event>

We went ahead and took back up of IIS configuration by running following command from inetsrv directory. For more details about how to take backup please visit the link, https://blogs.iis.net/bills/archive/2008/03/24/how-to-backup-restore-iis7-configuration.aspx

C:\Windows\System32\inetsrv>appcmd add backup 30102009
BACKUP object "30102009" added

Note: To uninstall Web Server Role from IIS 7.0 server, please make sure that Windows Activation Service Feature is uninstalled. While we try to uninstall WAS, its dependent IIS as well is removed from the box.

Although we tried to remove WAS, which in turn removed IIS, after reboot we found that server was trying to install updates and that was not successful. Something was causing this to happen, which we were not sure about.

What would be the CAUSE?

From the above event viewer entry it was clear that some Windows Servicing failed to complete the process of setting package, WUClient-SelfUpdate-Core, with different package names.

We looked in CBS.log file (C:\windows\Logs\CBS\CBS.log file) and found the following

9-10-26 15:31:47, Info CBS RA: Skipping package: WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~en-US~7.1.6001.65, not self-owned.
2009-10-26 15:31:47, Info CBS RA: Skipping package: WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~en-US~7.2.6001.788, not self-owned.
2009-10-26 15:31:47, Info CBS RA: Skipping package: WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~~7.1.6001.65, not self-owned.
2009-10-26 15:31:47, Info CBS RA: Skipping package: WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~~7.2.6001.788, not self-owned.

Note: The above are examples of few package names.

There was more such patches, infact there were more such patches that are stuck in Pending State. We confirmed that from registry, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackagesPending

We would see PackagesPending Key in registry, when the patches are struck in Pending State. This state had blocked the CBS (Component based Servicing) for this server.

In Windows Server 2008, CBS is the key installer for anything you need to install on this box.That includes IIS and other roles that might depend on CBS. In this current state, we will not be able to install any roles on this box.

We get into such state(PackagesPending) when we have CORRUPT UPDATE forced to be installed on the box.

How can we RESOLVE above issue?

We need to Run checksur by following KB, https://support.microsoft.com/kb/947821

Once we fix the CBS corrupt issue, we were able to uninstall and re-install IIS fine. We did not get any startup warning messages about the updates not getting installed properly.

Catch you later,

Vandana.

We wanted to use IPv4 Address and Domain Restrictions feature of IIS 7.0 server. We wanted to restrict one particular computer from accessing the IIS server or accessing particular website on IIS server.

We added the particular IP address in the Deny Restriction List, we see the mode as Deny for that specific IP Address.

We then go ahead and edit the above setting by clicking on Edit Feature Settings

We see the following options. We select Deny, as we want that specific machine’s IP address, denied from accessing the website.

If we want to select the check box we can do that as well. This is for reverse look up for the specific IP address in DNS. 

After doing all these and once we do an iisreset, to be sure that all changes are in place, but still we see that if we access the website from the machine, for which we have denied access, we see that we are still able to access the website.

This means that we are still missing on something, which is making this to happen and not work as expected.

After enough research on this, we found that this feature’s name is IPv4 Address and Domain Restriction and this looks and configures only IPv4 addresses.

In order to make the above stuff to work we had to add the IPv6 address of that machine into the Deny Restriction List. But GUI does not provide the option of adding IPv6 address of that machine. So to do this we need to edit the applicationHost.config file (found in location, C:\Windows\System32\inetsrv\config) and add manually the IPv6 entry into it.

Note: Be careful while editing the applicationHost.config. As even a small entry error would have a major impact like IIS not starting up correctly.

To do this, first we try to find the IPv4 entry in the applicationHost.config file.

<ipSecurity enableReverseDns="true" allowUnlisted="true">
        <add ipAddress="192.168.0.1" allowed="false" />
  </ipSecurity>

Tried finding the IPv6 address of that particular machine. You can do IPConfig /All from the command prompt and copy the IPv6 address and then please add that address as follows in the applicationHost.config file.

    <add ipAddress="2001:4898:7001:f001:0:5efe" subnetMask="ffff:ffff::" allowed="false" />

So the entire entry would look as follows

<ipSecurity enableReverseDns="true" allowUnlisted="true">
        <add ipAddress="192.168.0.1" allowed="false" />
    <add ipAddress="2001:4898:7001:f001:0:5efe" subnetMask="ffff:ffff::" allowed="false" />
  </ipSecurity>

After this once we do iisreset, and refresh IIS Manager snap-in, we can see the above entry displayed in GUI. After this go ahead and try to access the website from the machine, for which we have denied access, we would see the following error.

403.6 - IP address rejected.

After this, in order to provide support for IPv6 Addresses, Microsoft introduced new extension called Dynamic IP Restrictions and you can find more details at following site

https://www.iis.net/extensions/DynamicIPRestrictions

https://learn.iis.net/page.aspx/548/using-dynamic-ip-restrictions/

You can download the extension and play with it as well.

For more details please refer following link

https://technet.microsoft.com/en-us/library/cc731598(WS.10).aspx

https://technet.microsoft.com/en-us/library/cc733090(WS.10).aspx 

Many more to come!

Until then bye from Vandana

Service Unavailable

--------------------------------------------------------------------------------

HTTP Error 503. The service is unavailable.

-- Following is the snap-shot of the error message.

Since I knew for sure that requests are not even reaching IIS server, so went ahead and looked in the HTTPErr logfile (found in location C:\Windows\System32\LogFiles). Found the following entries in it.

#Version: 1.0

#Date: 2009-07-24 02:05:29

#Fields: date time c-ip c-port s-ip s-port cs-version cs-method cs-uri sc-status s-siteid s-reason s-queuename

2009-07-26 13:22:57 ::1%0 49161 ::1%0 80 HTTP/1.1 GET /iisstart.htm 503 1 AppOffline DefaultAppPool

2009-07-26 13:24:36 ::1%0 49162 ::1%0 80 HTTP/1.1 GET /iisstart.htm 503 1 AppOffline DefaultAppPool

2009-07-26 13:27:27 ::1%0 49163 ::1%0 80 HTTP/1.1 GET /iisstart.htm 503 1 AppOffline DefaultAppPool

2009-07-26 13:29:29 ::1%0 49165 ::1%0 80 HTTP/1.1 GET /time.asp 503 1 AppOffline DefaultAppPool

So we could conclude that Application Pool was getting offline, but the reason for it was not clear. Decided to look into the event viewer, as the application pool was getting disabled, IIS would for sure log it in event viewer. Checked in the System event logs and found the following

Log Name: System

Source: Microsoft-Windows-WAS

Date: 26-07-2009 06:29:29

Event ID: 5002

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: COMP2008

Description:

Application pool 'DefaultAppPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="49152">5002</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2009-07-26T13:29:29.000Z" />

<EventRecordID>20838</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>COMP2008</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Binary>

</Binary>

</EventData>

</Event>

Log Name: System

Source: Microsoft-Windows-WAS

Date: 26-07-2009 06:29:29

Event ID: 5139

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: COMP2008

Description:

A listener channel for protocol 'http' in worker process '2252' serving application pool 'DefaultAppPool' reported a listener channel failure. The data field contains the error number.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="32768">5139</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2009-07-26T13:29:29.000Z" />

<EventRecordID>20837</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>COMP2008</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Data Name="ProcessID">2252</Data>

<Data Name="param3">0</Data>

<Data Name="ProtocolID">http</Data>

<Binary>05400080</Binary>

</EventData>

</Event>

Although thought that there would not be anything logged in Application event viewer, to my surprise I found something interesting which helped me in resolving the issue..

Log Name: Application

Source: Microsoft-Windows-IIS-W3SVC-WP

Date: 28-07-2009 19:05:54

Event ID: 2293

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: COMP2008

Description:

The Module name FastcgiTesting-Register path C:\Windows\System32\inetsrv\iisfcgi.dll returned an error from registration. The data is the error.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-IIS-W3SVC-WP" Guid="{670080D9-742A-4187-8D16-41143D1290BD}" EventSourceName="W3SVC-WP" />

<EventID Qualifiers="49152">2293</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2009-07-29T02:05:54.000Z" />

<EventRecordID>1163</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>COMP2008</Computer>

<Security />

</System>

<EventData>

<Data Name="ModuleDll">FastcgiTesting-Register</Data>

<Data Name="Path">C:\Windows\System32\inetsrv\iisfcgi.dll</Data>

<Binary>05400080</Binary>

</EventData>

</Event>

Log Name: Application

Source: Microsoft-Windows-IIS-W3SVC-WP

Date: 28-07-2009 19:05:45

Event ID: 2293

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: COMP2008

Description:

The Module name FastcgiTesting-Register path C:\Windows\System32\inetsrv\iisfcgi.dll returned an error from registration. The data is the error.

Event Xml:

<Event xmlns="https://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-IIS-W3SVC-WP" Guid="{670080D9-742A-4187-8D16-41143D1290BD}" EventSourceName="W3SVC-WP" />

<EventID Qualifiers="49152">2293</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2009-07-29T02:05:45.000Z" />

<EventRecordID>1161</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>Application</Channel>

<Computer>COMP2008</Computer>

<Security />

</System>

<EventData>

<Data Name="ModuleDll">FastcgiTesting-Register</Data>

<Data Name="Path">C:\Windows\System32\inetsrv\iisfcgi.dll</Data>

<Binary>05400080</Binary>

</EventData>

</Event>

So we could atleast now conclude that there was FastcgiTesting-Register Module, which tried registering itself and failed to register successfully. (Now I remembered that I was playing with FCGI Module some days back and somehow did not completely finish the module and left the incomplete module in IIS, without removing them). Since this registration was not successful, Application Pool was unable to start itself.

Went ahead and removed the mapping from Server Level. To do this we did the following

1. Highlighted the computer name in IIS Manager and under Features View -> Selected the Modules -> Right Click -> Open Feature.

2. Tried looking in for the name FastcgiTesting-Register Module.

3. Went ahead and selected that and clicked on Remove from Actions pane.

4. Did iisreset.

Now we thought that we had completely removed from IIS and now went ahead and tried browsing the iisstart.htm page and still the same error as above. In event logs still we were seeing the same errors. It had not gone. Checked all locations in IIS Manager and could not find any. Now finally decided to open up applicationHost.config file ( Found in location: C:\Windows\System32\inetsrv\config). Tried looking in for the keyword (FastcgiTesting-Register) and to my surprise I found one at <globalModules> section.

<globalModules>

<add name="FastcgiTesting-Register" image="C:\Windows\System32\inetsrv\iisfcgi.dll" preCondition="" />

</globalModules>

Went ahead and manually removed the line from applicationHost.config file and then saved them. (Note: Directly editing applicationHost.config file may cause other issues. So please make sure that it is edited carefully). Did iisreset and then tried to browse to iisstart.htm and this time it came up fine without any issues.

Learning:

Please make sure that whatever labs are performed on IIS server, please take a back-up of IIS and then once the lab is completed, please restore the working server configuration. This would save a lot time, which we ended up spending for the above issue.

With this I conclude, will share many more in future.

Until then bye :)

Vandana

—I had a fresh install of Out-Of-Band(OOB) FTP 7 module. You can download it from following location:

X64: https://www.iis.net/downloads/default.aspx?tabid=34&i=1620&g=6

X86: https://www.iis.net/downloads/default.aspx?tabid=34&i=1619&g=6

-- Installed it and created a test FTP site with default settings and tried to browse it and we got the following error

-- Looked in FTP logs, found in location (C:\inetpub\logs\LogFiles\FTPSVC<ID>)

#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus x-session x-fullpath

2009-03-17 16:51:31 ::1 - ::1 21 ControlChannelOpened - - 0 0 205730aa-6f71-43f1-a0e9-ae775b892e7a -

2009-03-17 16:51:31 ::1 - ::1 21 USER anonymous 534 5 25 205730aa-6f71-43f1-a0e9-ae775b892e7a -

2009-03-17 16:51:31 ::1 - ::1 21 ControlChannelClosed - - 0 0 205730aa-6f71-43f1-a0e9-ae775b892e7a -

-- We knew for sure that we are running into access denied issue for anonymous user.

-- Ran procmon and we did see access denied but specific to our issue.

-- Looked in Services.msc and found that Microsoft FTP Service was not started up.

-- Tried to manually start it up and we got the following error

---------------------------

Services

---------------------------

Windows was unable to open service FTP Publishing Service for reading on Local Computer.

Error 1060: The specified service does not exist as an installed service.

---------------------------

OK

---------------------------

-- As it was fresh install, tried to uninstall the OOB Microsoft FTP Service for IIS 7.0 and then installed it again.

NOTE: This is NOT the resolution, but we did that as we were trying to make our FTP site work.

-- Tried to enable extended logging by going to following location.

-- Just to be specific, went ahead and checked all the options. Main thing to check would be Additional Information (x-debug)

-- In FTP logs we got the following entries. “x-debug” is the main thing to check here.

#Software: Microsoft Internet Information Services 7.0

#Version: 1.0

#Date: 2009-03-17 19:51:56

#Fields: date time c-ip c-port cs-username s-sitename s-computername sc-host s-ip s-port cs-method cs-uri-stem sc-status sc-win32-status sc-substatus sc-bytes cs-bytes time-taken x-session x-fullpath x-debug

2009-03-17 19:51:56 ::1 56393 – FTPSVC<ID> <ComputerName> - ::1 21 ControlChannelOpened - - 0 0 0 0 0 de582c8c-5f2b-4419-bef1-16c90b28925e - -

2009-03-17 19:51:56 ::1 56393 – FTPSVC<ID> <ComputerName> - ::1 21 USER anonymous 534 5 25 133 16 0 de582c8c-5f2b-4419-bef1-16c90b28925e - SSL+policy+requires+SSL+for+control+channel.

2009-03-17 19:51:56 ::1 56393 – FTPSVC<ID> <ComputerName> - ::1 21 ControlChannelClosed - - 0 0 160 16 0 de582c8c-5f2b-4419-bef1-16c90b28925e - -

-- From x-debug information, we got the following information

SSL+policy+requires+SSL+for+control+channel.

-- Went ahead and found under FTP SSL settings, that Require SSL connection option is checked.

-- We did not have Certificate assigned to the FTP site and so changed it to Allow SSL connections and stopped and restarted the FTP service by doing the following

To stop FTP service: net stop ftpsvc

To start FTP service: net start ftpsvc.

-- Tried to access ftp://localhost and we were able to get to the ftpsite fine.

-- To enable the Folder View for FTP we need to do the following

Please refer following KB article, written by me, for FTP 7.0 status and sub-status code.

The FTP 7.0 status codes in IIS 7.0

https://support.microsoft.com/kb/969061

When dragging and dropping controls in design view of Visual Studio 2005 - Getting error "Attempted to read or write protected memory"

Issue Description:

-- Getting following pop-up error when trying to drag and drop Microsoft Controls in Visual Studio 2005 design view

---------------------------

Microsoft Visual Studio

---------------------------

Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

---------------------------

OK   Help  

---------------------------

Resolution:

-- There was something wrong with the registration of VS packages. We reset those and it resolved the issue.

-- We ran the following command from the

C:\Program Files\Microsoft Visual Studio 8\Common7\IDE>devenv.exe /ResetSkipPkgs

-- We opened the existing project in Visual Studio 2005 and now we did not get the above error while dragging and dropping Microsoft and non-Microsoft Controls.

-- Tried closing and opening up the project again and still no issues.

More Information:

/ResetSkipPkgs (devenv.exe)

<https://msdn.microsoft.com/en-us/library/ms241276(VS.80).aspx>

Devenv Command Line Switches 

<https://msdn.microsoft.com/en-us/library/xee0c8y7(VS.80).aspx>

Redirect the default iisadmpwd virtual directory’s page to aexp2b.asp page instead of aexp.asp

-- Customer wanted to display the domain name label and text box populated in the password change page (same page when we try to browse aexp2b.asp page), when he was getting redirected to password change pages, when the user’s password was expired.

-- By default the iisadmpwd (password change) virtual directory takes to the page, which **by default** does not display the domain label and text box, to populate the domain name. Here is the snap-shot

Figure 1

-- This is indicated by the following entry in the Metabase.xml file (C:\WINDOWS\system32\inetsrv\iisadmpwd)

AuthExpiredURL="/iisadmpwd/aexp.asp"

Why customer wanted this?

-- Their users might be confused to just add Username instead of Domain\Username, if Username field alone is populated in the password change page.

-- So cust wanted the following page, which would have the domain field populated. Following is the snap-shot, which shows the domain field as well displayed. This is the snap-shot from aexp2b.asp page

Figure 2

Resolution:

To achieve this:

-- Went ahead and changed the path in IIS metabase to the following as cust wanted to display the aexp2b.asp page (same as figure 2)

AuthExpiredURL="/iisadmpwd/aexp2b.asp"

-- We can set it via the command prompt.

C:\Inetpub\AdminScripts>cscript adsutil.vbs get w3svc/AuthExpiredURL

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

AuthExpiredURL                  : (STRING) "/iisadmpwd/aexp.asp"

C:\Inetpub\AdminScripts>cscript adsutil.vbs set w3svc/AuthExpiredURL "/iisadmpwd/aexp2b.asp"

Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

AuthExpiredURL                  : (STRING) "/iisadmpwd/aexp2b.asp"

--Do an iisreset.

-- After this when users password expires and they are redirected to password change page, they would **BY DEFAULT** be taken to aexp2b.asp page instead of aexp.asp page(once the above change is done).

More Information:

-- Here are the default settings for our iisadmpwd Virtual Directory in the Metabase.xml. For more details check the KB-833734

passwordchangeflags is set to 1 if we want to browse the VD on https://

passwordchangeflags is set to 0 if we want to browse the iisadmpwd on https://

-- In Metabase.xml file following is the default entries for the iisadmpwd setting.

AuthChangeURL="/iisadmpwd/achg.asp"

AuthExpiredURL="/iisadmpwd/aexp.asp"

AuthExpiredUnsecureURL="/iisadmpwd/aexp3.asp"

AuthNotifyPwdExpURL="/iisadmpwd/anot.asp"

AuthNotifyPwdExpUnsecureURL="/iisadmpwd/anot3.asp"

HTTPS Request:

-- So **BY DEFAULT** when anyone browses to website with account, whose password is about to expire, he/she would **BY DEFAULT** be taken to aexp.asp page on https://.

-- Following is the Metabase entry

AuthExpiredURL="/iisadmpwd/aexp.asp"

-- Tested that and in IIS logs got the following entries when we browse it on https://

<Date> 22:25:37 W3SVC1 127.0.0.1 GET /time.asp - 443 - 127.0.0.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 401 2 2148074254

<Date> 22:25:46 W3SVC1 127.0.0.1 GET /iisadmpwd/aexp.asp <URL> 443 - 127.0.0.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 200 0 0

HTTP Request:

-- On https://, they are **BY DEFAULT** taken to aexp3.asp. Following is the Metabase entry

AuthExpiredUnsecureURL="/iisadmpwd/aexp3.asp"

-- Following is the IIS logs entry.

<Date> 22:10:34 W3SVC1 127.0.0.1 GET /time.asp - 80 - 127.0.0.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 401 2 2148074254

<Date> 22:10:59 W3SVC1 127.0.0.1 GET /iisadmpwd/aexp3.asp <URL> 80 - 127.0.0.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 200 0 0

-- Went ahead and changed the path in IIS metabase to the following as cust wanted to display the aexp2b.asp page. More details are explained above under Resolution Section.

AuthExpiredURL="/iisadmpwd/aexp2b.asp"

-- After following the Resolution section above got the following entries in IIS logs.

-- Following is the entry in IIS logs

<Date> 23:12:39 W3SVC1 127.0.0.1 GET /time.asp - 443 - 127.0.0.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 401 2 2148074254

<Date> 23:12:47 W3SVC1 127.0.0.1 GET /iisadmpwd/aexp2b.asp <URL> 443 - 127.0.0.1 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727) 200 0 0

file	An ordered set of computer data (including programs), of arbitrary length, uniquely identified by a pathname.
mode	The mode in which data is to be transferred via the data connection.The mode defines the data format during transfer including EOR and EOF.
NVT	The Network Virtual Terminal as defined in the Telnet Protocol.
page	A file may be structured as a set of independent parts called pages.FTP supports the transmission of discontinuous files as independent indexed pages.
pathname	Pathname is defined to be the character string which must be input to a file system by a user in order to identify a file. Pathname normally contains device and/or directory names, and file name specification. FTP does not yet specify a standard pathname convention.  Each user must follow the file naming conventions of the file systems involved in the transfer.
PI	The protocol interpreter.  The user and server sides of the protocol have distinct roles implemented in a user-PI and a server-PI.
record	A sequential file may be structured as a number of contiguous parts called records.  Record structures are supported by FTP but a file need not have record structure.
reply	A reply is an acknowledgment (positive or negative) sent from server to user via the control connection in response to FTP commands.  The general form of a reply is a completion code (including error codes) followed by a text string.  The codes are for use by programs and the text is usually intended for human users.
server-DTP	The data transfer process, in its normal "active" state, establishes the data connection with the "listening" data port. It sets up parameters for transfer and storage, and transfers data on command from its PI.  The DTP can be placed in a "passive" state to listen for, rather than initiate a connection on the data port.
server-FTP process	A process or set of processes which perform the function of file transfer in cooperation with a user-FTP process and, possibly, another server.  The functions consist of a protocol interpreter (PI) and a data transfer process (DTP).
server-PI	The server protocol interpreter "listens" on Port L for a connection from a user-PI and establishes a control communication connection.  It receives standard FTP commands from the user-PI, sends replies, and governs the server-DTP.
type	The data representation type used for data transfer and storage.  Type implies certain transformations between the time of data storage and data transfer.
user	A person or a process on behalf of a person wishing to obtain file transfer service.  The human user may interact directly with a server-FTP process, but use of a user-FTP process is preferred since the protocol design is weighted towards automata.
user-DTP	The data transfer process "listens" on the data port for a connection from a server-FTP process.  If two servers are transferring data between them, the user-DTP is inactive.
user-FTP process	A set of functions including a protocol interpreter, a data transfer process and a user interface which together perform the function of file transfer in cooperation with one or more server-FTP processes.  The user interface allows a local language to be used in the command-reply dialogue with the user.
user-PI	The user protocol interpreter initiates the control connection from its port U to the server-FTP process, initiates FTP commands, and governs the user-DTP if that process is part of the file transfer.

The following commands specify access control identifiers (command codes are shown in parentheses).

USER NAME (USER)	The argument field is a Telnet string identifying the user. The user identification is that which is required by the server for access to its file system.  This command will normally be the first command transmitted by the user after the control connections are made (some servers may require this).  Additional identification information in the form of a password and/or an account command may also be required by some servers.  Servers may allow a new USER command to be entered at any point in order to change the access control and/or accounting information.  This has the effect of flushing any user, password, and account information already supplied and beginning the login sequence again.  All transfer parameters are unchanged and any file transfer in progress is completed under the old access control parameters
PASSWORD (PASS)	The argument field is a Telnet string specifying the user's password.  This command must be immediately preceded by the user name command, and, for some sites, completes the user's identification for access control. Since password information is quite sensitive, it is desirable in general to "mask" it or suppress type out. It appears that the server has no foolproof way to achieve this. It is therefore the responsibility of the user-FTP process to hide the sensitive password information.
ACCOUNT (ACCT)	The argument field is a Telnet string identifying the user's account.  The command is not necessarily related to the USER command, as some sites may require an account for login and others only for specific access, such as storing files. In the latter case the command may arrive at any time. There are reply codes to differentiate these cases for the automation: when account information is required for login, the response to a successful PASSword command is reply code 332.  On the other hand, if account information is NOT required for login, the reply to a successful PASSword command is 230; and if the account information is needed for a command issued later in the  dialogue, the server should return a 332 or 532 reply depending on whether it stores (pending receipt of the ACCounT command) or discards the command, respectively.
CHANGE WORKING DIRECTORY (CWD)	This command allows the user to work with a different directory or dataset for file storage or retrieval without altering his login or accounting information.  Transfer parameters are similarly unchanged.  The argument is a pathname specifying a directory or other system dependent file group designator.
CHANGE TO PARENT DIRECTORY (CDUP)	This command is a special case of CWD, and is included to simplify the implementation of programs for transferring directory trees between operating systems having different syntaxes for naming the parent directory. The reply codes shall be identical to the reply codes of CWD.
STRUCTURE MOUNT (SMNT)	This command allows the user to mount a different file system data structure without altering his login or accounting information. Transfer parameters are similarly unchanged.  The argument is a pathname specifying a directory or other system dependent file group designator.
REINITIALIZE (REIN)	This command terminates a USER, flushing all I/O and account information, except to allow any transfer in progress to be completed. All parameters are reset to the default settings and the control connection is left open. This is identical to the state in which a user finds himself immediately after the control connection is opened. A USER command may be expected to follow.
LOGOUT (QUIT)	This command terminates a USER and if file transfer is not in progress, the server closes the control connection.  If file transfer is in progress, the connection will remain open for result response and the server will then close it. If the user-process is transferring files for several USERs but does not wish to close and then reopen connections for each, then the REIN command should be used instead of QUIT. An unexpected close on the control connection will cause the server to take the effective action of an abort (ABOR) and a logout (QUIT).

TRANSFER PARAMETER COMMANDS

DATA PORT (PORT)	The argument is a HOST-PORT specification for the data port to be used in data connection.  There are defaults for both the user and server data ports, and under normal circumstances this command and its reply are not needed.  If this command is used, the argument is the concatenation of a 32-bit internet host address and a 16-bit TCP port address. This address information is broken into 8-bit fields and the value of each field is transmitted as a decimal number (in character string  representation). The fields are separated by commas.  A port command would be:                PORT h1,h2,h3,h4,p1,p2 where h1 is the high order 8 bits of the internet host address.
PASSIVE (PASV)	This command requests the server-DTP to "listen" on a data port (which is not its default data port) and to wait for a connection rather than initiate one upon receipt of a transfer command. The response to this command includes the host and port address this server is listening on.
REPRESENTATION TYPE (TYPE)	The argument specifies the representation type
FILE STRUCTURE (STRU)	The argument is a single Telnet character code specifying file structure described in the Section on Data Representation and Storage. The following codes are assigned for structure:                F - File (no record structure)                R - Record structure                P - Page structure The default structure is File.
TRANSFER MODE (MODE)	The argument is a single Telnet character code specifying the data transfer modes described in the Section on Transmission Modes. The following codes are assigned for transfer modes:                S - Stream                B - Block                C - Compressed The default transfer mode is Stream.

FTP SERVICE COMMANDS:

The FTP service commands define the file transfer or the file system function requested by the user. The argument of an FTP service command will normally be a pathname.  The syntax of pathnames must confirm to server site conventions (with standard defaults applicable), and the language conventions of the control connection.  The suggested default handling is to use the last specified device, directory or file name, or the standard default defined for local users.  The commands may be in any order except that a "rename from" command must be followed by a "rename to" command and the restart command must be followed by the interrupted service command (e.g., STOR or RETR). The data, when transferred in response to FTP service commands, shall always be sent over the data connection, except for certain informative replies.  The following commands specify FTP service requests:

RETRIEVE (RETR)	This command causes the server-DTP to transfer a copy of the file, specified in the pathname, to the server- or user-DTP at the other end of the data connection.  The status and contents of the file at the server site shall be unaffected.
STORE (STOR)	This command causes the server-DTP to accept the data transferred via the data connection and to store the data as a file at the server site. If the file specified in the pathname exists at the server site, then its contents shall be replaced by the data being transferred. A new file is created at the server site if the file specified in the pathname does not already exist.
STORE UNIQUE (STOU)	This command behaves like STOR except that the resultant file is to be created in the current directory under a name unique to that directory.  The 250 Transfer Started response must include the name generated.
APPEND (with create) (APPE)	This command causes the server-DTP to accept the data transferred via the data connection and to store the data in  a file at the server site.  If the file specified in the pathname exists at the server site, then the data shall be appended to that file; otherwise the file specified in the pathname shall be created at the server site
ALLOCATE (ALLO)	This command may be required by some servers to reserve sufficient storage to accommodate the new file to be transferred.  The argument shall be a decimal integer representing the number of bytes (using the logical byte size) of storage to be reserved for the file.  For files sent with record or page structure a maximum record or page size (in logical bytes) might also be necessary; this is indicated by a decimal integer in a second argument field of the command.  This second argument is optional, but when present should be separated from the first by the three Telnet characters <SP> R <SP>.  This command shall be followed by a STORe or APPEnd command.The ALLO command should be treated as a NOOP (no operation) by those servers which do not require that the maximum size of the file be declared beforehand, and those servers interested in only the maximum record or page size should accept a dummy value in the first argument and ignore it.
RESTART (REST)	The argument field represents the server marker at which file transfer is to be restarted.  This command does not cause file transfer but skips over the file to the specified data checkpoint. This command shall be immediately followed by the appropriate FTP service command which shall cause file transfer to resume.
RENAME FROM (RNFR)	This command specifies the old pathname of the file which is to be renamed.  This command must be immediately followed by a "rename to" command specifying the new file pathname.
RENAME TO (RNTO)	This command specifies the new pathname of the file specified in the immediately preceding "rename from" command.Together the two commands cause a file to be renamed.
ABORT (ABOR)	This command tells the server to abort the previous FTP service command and any associated  transfer of data. The abort command may require "special action", to force recognition by the   server. No action is to be taken if the previous command has been completed (including data transfer). The control connection is not to be closed by the server, but the data connection must be closed. There are two cases for the server upon receipt of this command: (1) the FTP service command was already completed, or (2) the FTP service command is still in progress. In the first case, the server closes the data connection (if it is open) and responds with a 226 reply, indicating that the abort command was successfully processed. In the second case, the server aborts the FTP service in progress and closes the data connection, returning a 426 reply to indicate that the service request terminated abnormally.  The server then sends a 226 reply, indicating that the abort command was successfully processed.
DELETE (DELE)	This command causes the file specified in the pathname to be deleted at the server site.  If an extra level of protection is desired (such as the query, "Do you really wish to delete?"), it should be provided by the user-FTP process
REMOVE DIRECTORY (RMD)	This command causes the directory specified in the pathname to be removed as a directory (if the pathname is absolute) or as a subdirectory of the current working directory (if the pathname is relative).
MAKE DIRECTORY (MKD)	This command causes the directory specified in the pathname to be created as a directory (if the pathname is absolute) or as a subdirectory of the current working directory (if the pathname is relative).
PRINT WORKING DIRECTORY (PWD)	This command causes the name of the current working directory to be returned in the reply.
LIST (LIST)	This command causes a list to be sent from the server to the passive DTP.  If the pathname specifies a directory or other group of files, the server should transfer a list of files in the specified directory.  If the pathname specifies a file then the server should send current information on the file.  A null argument implies the user's current working or default directory.  The data transfer is over the data connection in type ASCII or type EBCDIC.  (The user must ensure that the TYPE is appropriately ASCII or EBCDIC). Since the information on a file may vary widely from system to system, this information may be hard to use automatically in a program, but may be quite useful to a human user.
NAME LIST (NLST)	This command causes a directory listing to be sent from server to user site.  The pathname should specify a directory or other system-specific file group descriptor; a null argument implies the current directory.  The server will return a stream of names of files and no other information. The data will be transferred in ASCII or EBCDIC type over the data connection as valid pathname strings separated by <CRLF> or <NL>.  (Again the user must ensure that the TYPE is correct.)  This command is intended to return information that can be used by a program to further process the files automatically. For example, in the implementation of a "multiple get" function.
SITE PARAMETERS (SITE)	This command is used by the server to provide services specific to his system that are essential to file transfer but not sufficiently universal to be included as commands in the protocol.  The nature of these services and the specification of their syntax can be stated in a reply to the HELP SITE command.
SYSTEM (SYST)	This command is used to find out the type of operating system at the server.  The reply shall have as its first word one of the system names listed in the current version of the Assigned Numbers document.
STATUS (STAT)	This command shall cause a status response to be sent over the control connection in the form of a reply. The command may be sent during a file transfer (along with the Telnet IP and Synch signals--see the Section on FTP Commands) in which case the server will respond with the status of the operation in progress, or it may be sent between file transfers. In the latter case, the command may have an argument field. If the argument is a pathname, the command analogous to the "list" command except that data shall be transferred over the control connection.  If a partial pathname is given, the server may respond with a list of file names or attributes associated with that specification. If no argument is given, the server should return general status information  about the server FTP process.  This should include current values of all transfer parameters and the status of connections.
HELP (HELP)	This command shall cause the server to send helpful information regarding its implementation status over the control connection to the user.  The command may take an argument (e.g., any command name) and return more specific information as a response.  The reply is type 211 or 214. It is suggested that HELP be allowed before entering a USER command. The server may use this reply to specify site-dependent parameters, e.g., in response to HELP SITE.
NOOP (NOOP)	This command does not affect any parameters or previously entered commands. It specifies no action other than that the server send an OK reply