security problem when accessing restricted page

External Since: Jul 27, 2004 Posts: 4

Hi,

i have a IIS 6 on Windows 2003.

On one of the websites i host, they have one ASP they use for entering data.
They wanted to secure that one page. So i made a user with a password, then
in the Windows Explorer on the security settings of that ASP i removed the
IIS_USER and added the newly created user with read and execute access. So
far so good, it worked for months. Now, from one day on another they can't
login anymore. Strange enough, their "master" account, i.e. the account they
use for ftp-upload of the complete site, is still allowed access.

So i thought it was something with that user. I first removed his rights on
that page and put them back, but that didn't help. I then completely deleted
that user and re-created it, but that didn't help either. Then i created a
completely new user, with a completely different name, and gave him the
rights on that page. No access.

Then i made a testpage on my own website, gave those two new users
permission on it and removed the anonymous user, but i could't get access.
Then i thought: let's try that "master" account on my testpage, and when i
added it to the security settings for the page, and tried to open the page,
it wouldn't work either.

So i'm kind of stuck with the fact that the pages that are already secured
still remain, but that i can't add new users to them.

The only thing that changed a.f.a.i. know are the updates that i installed
through Windows Update. Could there be a problem with that? i.e. that one of
the updates changed a setting?

Any ideas?

Thx in advance!

Mr. T

External Since: Aug 22, 2003 Posts: 1637

"Mr. T." <me RemoveThis @myself.net> wrote in message
news:2qvsvtF14nai9U1@uni-berlin.de...
> Hi,
>
> i have a IIS 6 on Windows 2003.
>
> On one of the websites i host, they have one ASP they use for entering
> data.
> They wanted to secure that one page. So i made a user with a password,
> then
> in the Windows Explorer on the security settings of that ASP i removed the
> IIS_USER and added the newly created user with read and execute access. So
> far so good, it worked for months. Now, from one day on another they can't
> login anymore. Strange enough, their "master" account, i.e. the account
> they
> use for ftp-upload of the complete site, is still allowed access.
>
> So i thought it was something with that user. I first removed his rights
> on
> that page and put them back, but that didn't help. I then completely
> deleted
> that user and re-created it, but that didn't help either. Then i created a
> completely new user, with a completely different name, and gave him the
> rights on that page. No access.
>
> Then i made a testpage on my own website, gave those two new users
> permission on it and removed the anonymous user, but i could't get access.
> Then i thought: let's try that "master" account on my testpage, and when i
> added it to the security settings for the page, and tried to open the
> page,
> it wouldn't work either.
>
> So i'm kind of stuck with the fact that the pages that are already secured
> still remain, but that i can't add new users to them.
>
> The only thing that changed a.f.a.i. know are the updates that i installed
> through Windows Update. Could there be a problem with that? i.e. that one
> of
> the updates changed a setting?
>
> Any ideas?

Windows Update should not have affected this. Specifically what error is
there when a user is denied access?

HOW TO: Configure IIS Web Site Authentication in Windows Server 2003
<a style='text-decoration: underline;' href="http://support.microsoft.com/default.aspx?scid=kb;en-us;324274" target="_blank">http://support.microsoft.com/default.aspx?scid=kb;en-us;324274</a>

--
Tom Kaminski IIS MVP
<a style='text-decoration: underline;' href="http://www.microsoft.com/windowsserver2003/community/centers/iis/" target="_blank">http://www.microsoft.com/windowsserver2003/community/centers/iis/</a>
<a style='text-decoration: underline;' href="http://mvp.support.microsoft.com/" target="_blank">http://mvp.support.microsoft.com/</a>
<a style='text-decoration: underline;' href="http://www.iisfaq.com/" target="_blank">http://www.iisfaq.com/</a>
<a style='text-decoration: underline;' href="http://www.iistoolshed.com/" target="_blank">http://www.iistoolshed.com/</a> - tools, scripts, and utilities for running IIS
<a style='text-decoration: underline;' href="http://www.tryiis.com" target="_blank">http://www.tryiis.com</a>