BillS IIS Blog : Compatibility

More Tips and Troubleshooting Help for Classic ASP Developers

bills — Fri, 20 Feb 2009 23:10:18 GMT

Back in May of 2007 I posted a tips for Classic ASP developers post which has since received more than 50 comments and 85,000 views. Robert McMurray just posted a set of fabulous tutorials for Classic ASP developers. If you’re out there and having issues with Classic ASP and IIS7 and need some help, you’re not alone! Read these articles to get help:

Classic ASP is not installed by default on IIS 7.0 and IIS 7.5

In IIS 7.0 and 7.5, the classic version of ASP is not installed by default. Because of this, you might see HTTP 404 errors when you try to browse to an ASP page on your server, or you might see the source code for your ASP page displayed in your browser window ...

Using Classic ASP with Microsoft Access Databases on IIS 7.0 and IIS 7.5

Note: Microsoft Access databases have been popular for many years with developers who use Active Server Pages (ASP) for small-scale applications, but Microsoft Access databases are not designed for scalability, therefore Access databases should only be used ...

Classic ASP script error messages are no longer shown in a Web browser by default

In earlier versions of IIS, error messages from classic ASP scripts were sent to a Web browser, by default. Because these error messages might reveal sensitive information to malicious users, IIS 7.0 disables this feature by default. When your classic ASP ...

Using Failed Request Tracing to troubleshoot Classic ASP errors

One of the great troubleshooting features that is built in to IIS 7.0 is Failed Request Tracing, which lets you configure tracing rules on your server that will create detailed troubleshooting log files for custom failure conditions that you define. For example ...

Classic ASP parent paths are disabled by default

Classic ASP Parent Paths let developers use relative addresses that contain ".." in the paths to files or folders. For example, the following code excerpt illustrates an ASP page that maps a parent path: % Response.Write Server.MapPath("../example.asp")%> ...

APPL_PHYSICAL_PATH Server Variable on Windows Vista RTM

The original release of IIS 7.0 that shipped with Windows Vista returned a different value for the APPL_PHYSICAL_PATH server variable than that which was returned by previous

How to Migrate from IIS 6 to IIS 7

bills — Wed, 18 Jun 2008 16:29:00 GMT

With so many cool new capabilities in IIS7, and even more new features coming out all the time, it's no wonder you want to move to IIS7. But you work for The Man, and everyone knows The Man wants ROI. He can't just let you go willy-nilly and adopt every cool new technology that hits the street. After all, He has a business to run. And that business currently runs on IIS 6. And he's paid you a lot of money (ok, not that much) to write the code, test the apps, deploy the servers, and keep those HTML pumping machines up and running 24x7x365. And things are running well, right? When was the last time you had to worry about metabase corruption? Or been forced to run IISRESET? Or been paged in the middle of the night with some glorious server 500 error and (of course) the developer who wrote the code is no where to be found?

Dear reader, I know your plight. I've been there before. I work for The Man too. And while he is a kinder, gentler boss as he moves into his old age (>30s!), he expects results.

This post is broken into three parts. 1) Sell the Boss 2) Get the Goods 3) Be the Hero (and migrate those servers!). If you're already sold on IIS7, jump to section 2 and 3 for instructions on how to actually migrate those IIS6 servers to IIS7 in a quick and painless way.

Sell the Boss

So how do you sell The Man on moving to IIS7? Here is my quick top 10 list, email me if you need more help:

IIS7 is faster and more efficient than any other version of IIS.
With IIS7 you can m anage whole Web farms from one place
IIS7 allows you to delegate management workload with site owners. Site owners can also remotely manage their sites and applications over HTTPS from Windows Vista, Windows XP, Windows Server 2003, and Windows Server 2008. IIS7's XCopy deployment model even allows you to deploy applications preconfigured!
IIS7 is much more flexible and customizable than before, allowing you to fine tune the server (including server core!) to minimize security footprint and downtime due to patching.
You can save loads of time by automating more tasks with the interface that is right for you.
If you do run into issues, IIS7 makes it easy to resolve site issues faster, minimizing down time due to that bone headed developer on your staff.
IIS7 includes built-in support for PHP, making it the best Web server for both Open Source languages and .NET. Why would you want to deploy, manage, patch and troubleshoot that Linux+Apache server to support those PHP apps, when you can just use Windows!?
IIS7 makes it easy to publish content securely over FTP/SSL or WebDAV!
Windows and IIS7 are cheaper than ever with the new Windows Web 2008 product. This version of Windows is super inexpensive and supports all the great features of IIS, Sharepoint, SQL, Windows Media server and more for Internet facing sites!
And as if that isn't enough, IIS7 is getting better every day with new IIS7 Extensions like built-in progressive streaming and playlist support for media content, URL Rewrite capabilities, integrated database management, powershell support, and much much more.

Get the Goods

If your company already has access to Windows Server 2008, you've paid all the money you'll ever need to pay in order to get IIS7 up and running. Have a cheap boss who wants to see the results first? Get the Windows Server 2008 trial edition which lets you try before you buy. I recommend the Windows Web Server 2008 for Internet facing sites, or Standard server for intranet ones. Note: IIS7 also ships with Windows Vista, which you can use for development and testing of your applications.

Now that you've got IIS7, it's time to get the migration tool (x86) and (x64). Ok, it is a WHOLE LOT MORE than just a migration tool, but this article is about migrating, and the Microsoft Web Deployment tool was built specifically with migration from IIS6 to IIS7 in mind. Download it now, use it to not only migrate from IIS6 to IIS7, but to archive (snapshot) your entire site/server (including configuration, content, certificates, etc.). You can also use it to do live synchronization of your IIS6 or IIS7 sites or servers in a web farm. MS Deploy is going to be your new best friend, be nice to it.

Be the Hero (and migrate those servers!)

This step is documented very nicely in the learn.iis.net portal under deployment, but I'll shamelessly steal from there to make your life easier. If things don't work (any longer), you might want to check the official documentation for the latest updates, or see Troubleshooting MS Deploy. This section assumes you've already downloaded MS Deploy and have installed it successfully. (see "Get the Goods")

Part 1 - View dependencies of the source

1. Get the dependencies of the web site by running the following command:

msdeploy -verb:getDependencies -source:metakey=lm/w3svc/1

2. Review the output of the dependencies and look for any script maps or installed components in use by the site. For example, if Windows Authentication is in use by the web site, you will see <dependency name="WindowsAuthentication" />.

3. If your site is inheriting any script maps, these will not be listed in the dependencies and you should also review the script maps for your site manually.

4. Compile a list of the components needed on the destination.

For detailed steps on analyzing the output of getDependencies, see Viewing Dependencies of a Web site.

Part 2 - Configure the target or destination machine

1. Review the list of dependencies and install them on the destination server.

For example, let’s assume you had the following in use for your web site:

• ASP.NET

• Windows Authentication

• Anonymous Authentication

Based on analyzing your dependencies, you would install those components and modules.

Part 3 – To migrate the site to the source server

1. Always make a backup of the destination server. Even if you are just testing, it allows you to easily restore the state of your server. Run the following command to backup an IIS 7.0 server:

%windir%\system32\inetsrv\appcmd add backup “PreMsDeploy”

2. Run the following command on the destination server to take an archive of the server for migration:

msdeploy -verb:sync -source:metakey=lm/w3svc/1 -dest:archivedir=c:\site1archive

3. Run the following command on the destination server to validate what would happen if a migrate was run:

msdeploy -verb:migrate -source:archivedir=c:\site1archive -dest:metakey=lm/w3svc/1 -whatif > msdeploymigrate.log

Note: If you don't wish to sync from an archive, you can sync using the remote service. Specify computerName with the name of your server, such as Server1. If you are not running on the default port and URL, you need to specify the full URL, such as http://Server1:8080/msdeploy. For example, change the source to
source:metakey=lm/w3svc/1,computerName=server1

3. After verifying the output, run the same command again without the whatif flag:

msdeploy -verb:migrate -source:archivedir=c:\site1archive -dest:metakey=lm/w3svc/1 -whatif > msdeploymigrate.log

Note: If you don't wish to sync from an archive, you can sync using the remote service. Specify computerName with the name of your server, such as Server1. If you are not running on the default port and URL, you need to specify the full URL, such as http://Server1:8080/msdeploy. For example, change the dest to
dest:metakey=lm/w3svc/1,computerName=server1

You are now done migrating your site. To verify, test browsing to the web site on the destination server. For troubleshooting help, see Troubleshooting MS Deploy.

How to install ASP.NET 1.1 with IIS7 on Vista and Windows 2008

bills — Mon, 02 Jun 2008 23:53:00 GMT

Overview

ASP.NET 2.0 (3.0 and 3.5) are easy to install with Windows Vista and Windows 2008 - just install the ASP.NET component located under IIS->Word Wide Web Services->Application Development Features. You can find this set of components in Windows 2008 by clicking Start, and click Server Manager. Expand the left-hand treeview in Server Manager and click Manage Roles, and then Web Server (IIS). In the right-hand pane look for an option that says Add Role Services. If you're on Windows Vista, click Start, click Control Panel, click Programs, and then Windows Features. Look for the following tree of features under Internet Information Services (IIS):

ASP.NET 1.1 is not included in Windows Vista or Windows 2008 and must be downloaded and installed manually. This post shows you how:

Step 1: Install "IIS Metabase Compatibility"

The IIS7 "Metabase compatibility" component is required to successfully install ASP.NET 1.1.

To install it on Windows 2008 Server, click Start, and click Server Manager. Expand the left-hand treeview in Server Manager and click Manage Roles, and then Web Server (IIS). In the right-hand pane look for an option that says Add Role Services. This takes you to wizard where you can install "IIS Metabase Compatibility".

If you're on Windows Vista, click Start, click Control Panel, click Programs, and then Windows Features. Look for Internet Information Services (IIS) and install "IIS Metabase Compatibility".

Step 2: Install the .NET Framework v1.1 and .NET Framework v1.1 SP1

Install Framework v1.1, SP1, and ASP.NET's security update to SP1:

When you install .NET Framework Version 1.1, and SP1 for .NET Framework Version 1.1, you'll see the following dialog. Click Run program.

note: If you do not install Framework v1.1 SP1, you may run into Data Execution Prevention errors with messages like "IIS Worker Process has stopped working". This is expected. Installing .NET Framework v1.1 SP1 will fix this.

Step 3: Enable ASP.NET v1.1 ISAPI Extension

Enable ASP.NET v1.1 ISAPI as an allowed ISAPI extension. To do this, open "IIS Manager" administration tool. In the features view, click on the "ISAPI and CGI Restrictions" feature. In the actions pane, click "add"

Extension: C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
note: change drive if your system drive is not C:\
Description: ASP.NET v1.1

You can also do by running the following command line:

%windir%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis -enable

Step 4: Add IgnoreSection Handler to v1.1 machine.config

ASP.NET v1.1 will throw runtime exceptions out of the box if you have IIS configuration in the web.config files that are read by your ASP.NET v1.1 applications. To make ASP.NET v1.1 ignore IIS configuration sections, open the Framework v1.1 machine.config file (%windir%\Microsoft.NET\Framework\v1.1.4322\config\machine.config) and add the following section entry just above the bottom tag for the <configSections> element:

Step 5: Move Site or Application to ASP.NET 1.1 Application Pool

During installation, Framework v1.1 creates an application pool called "ASP.NET 1.1" that is configured to load Framework v1.1 upon startup. To move your site or application into this application pool using IIS Manager, please see our online documentation. You can also do this from the command line by navigating to the %windir%\system32\inetsrv directory and running the following command line:

appcmd set app "Default Web Site/" /applicationPool:"ASP.NET 1.1"

If you would like to create a new application pool that's configured to load Framework v1.1, please see our online documentation for creating an application pool. You can also do this from the command line by navigating to the %windir%\system32\inetsrv directory and running the following command line:

appcmd add apppool /name:"NewPool"  /managedRuntimeVersion:"v1.1"

Tips for Classic ASP developers on IIS7

bills — Tue, 22 May 2007 00:11:00 GMT

I was reminded the other day just how many classic ASP applications and developers there are out there! The original ASP rocks, I remember experiencing it for the first time back in 1996/97 when it first came out with IIS3, and being amazed at how programmable it was compared to ColdFusion. I built many an application using Classic ASP, and there will always be a soft spot in my heart for it. :)

There are a few changes in IIS7 which Classic ASP developers should be aware of.

ASP not installed by default

First things first! If you're moving from XP to Windows Vista / Longhorn Server, you may be getting this error:

--------------------------------------------------------------------------------------------------------------------

HTTP Error 404.3 - Not Found

Description: The page you are requesting cannot be served because of the Multipurpose Internet Mail Extensions (MIME) map policy that is configured on the Web server. The page you requested has a file name extension that is not recognized, and is not allowed.

--------------------------------------------------------------------------------------------------------------------

this is usually the case when you haven't installed the ASP component. Go to where you installed IIS and look under IIS/WWW Services/Application Development/ASP and install it. :)

Access and Classic ASP

A lot of people use Access as a database - because it is small, can be copied around, and is easy to manage. One of the changes we made in IIS7 in Vista broke using ASP and Access by default. I described this change in more detail in this post, but essentially it has to do with the fact that Application Pools now use the Application Pool identity's profile and temporary directory, rather than \windows\temp by default. And since the only one that can write to Network Service's temp directory is the Network Service, anonymous or authenticated ASP applications break, since ASP uses the impersonated identity to access the database. If you use ASP and Access on IIS7, you've probably seen this error, or a variation of it:

--------------------------------------------------------------------------------------------------------------------

Microsoft JET Database Engine error '80004005'
Unspecified error

--------------------------------------------------------------------------------------------------------------------

The answer is pretty straight forward: turn off loadUserProfile, or ACL the temp directory to allow writes. As a result of this and other compatibility issues, we're considering reverting this change in Longhorn Server / Vista SP1. In the mean time, you can work around it by doing either of the following:

This appcmd command will turn off loadUserProfile for the Default Application Pool. if your application runs in a different AppPool, make the corresponding change:

%windir%\system32\inetsrv\appcmd set config /section:applicationPools /[name='DefaultAppPool'].processModel.loadUserProfile:false

This command will ACL the Network Service temp directory to allow creator write / read privledges. If you run your Application Pool under a different identity, you'll need to ACL that owner's temp directory:

icacls %windir%\serviceprofiles\networkservice\AppData\Local\Temp /grant Users:(CI)(S,WD,AD,X)

icacls %windir%\serviceprofiles\networkservice\AppData\Local\Temp /grant "CREATOR OWNER":(OI)(CI)(IO)(F)

**Update 2/19/2009** if you are having issues with Access and ASP you might want to read this terrific guide recently posted on IIS.NET: http://learn.iis.net/page.aspx/563/using-classic-asp-with-microsoft-access-databases-on-iis-70-and-iis-75/

Script errors no longer shown in browser by default

As a result of our security paranoia, we turned off ASP's default behavior of sending script errors (including line number and code snippet to the browser. So instead of seeing the typical error you would see ASP throw, you will now see this:

--------------------------------------------------------------------------------------------------------------------

An error occurred on the server when processing the URL. Please contact the system administrator

--------------------------------------------------------------------------------------------------------------------

To revert back to IIS6- behavior, simply run the following command:

%windir%\system32\inetsrv\appcmd set config -section:asp -scriptErrorSentToBrowser:true

Or you can find it in the UI here:

then you'll be back to seeing this style of error instead:

--------------------------------------------------------------------------------------------------------------------

Microsoft VBScript compilation error '800a03ea'

Syntax error

/test.asp, line 4

Response.Write("I love classic ASP" && foo)
-------------------------------------^

--------------------------------------------------------------------------------------------------------------------

Parents paths disabled by default (redux)

We disabled parent paths by default with IIS6, but I've seen this hit people on Vista coming from XP, where it is still enabled by default in IIS5.1 The enableParentPaths setting determines where ASP "includes" should be allowed to escape the parent directory (eg. ../../../includeFile.inc). You'll see this error by default if you try to escape the current directory:

--------------------------------------------------------------------------------------------------------------------

Active Server Pages error 'ASP 0131'

Disallowed Parent Path

/test.asp, line 1

The Include file '../bad.inc' cannot contain '..' to indicate the parent directory.

--------------------------------------------------------------------------------------------------------------------

or you may see this error if you are using a path with ../ in it and your ADODB code

--------------------------------------------------------------------------------------------------------------------

Server.MapPath() error 'ASP 0175 : 80004005'

Disallowed Path Characters

/testdir/test.asp, line 9

The '..' characters are not allowed in the Path parameter for the MapPath method.

--------------------------------------------------------------------------------------------------------------------

To revert back to IIS 5.x behavior, simply run the following command:

%windir%\system32\inetsrv\appcmd set config -section:asp -enableParentPaths:true

or you can find the UI setting here:

APPL_PHYSICAL_PATH no longer returns "\" with path

If you use Request.ServerVariables("APPL_PHYSICAL_PATH") to get at the physical path for your application, you may notice that the physical path no longer returns with a trailing slash. In previous releases of IIS, we returned this value as stored in the metabase. In IIS7, we calculate this value based on the configuration store, and we never return a trailing slash. You'll need to account for this especially if you are the return value with some other part of the path in your application.

Session_OnEnd not firing

If you find that Session_onEnd event in your global.asa is not firing, check out this blog post from Lou on the issue and the fix.

Summary

I browsed through the IIS7 Classic ASP Forums, and these tips seemed to cover nearly all of the issues people were having. if you are having a problem with ASP on IIS7, check out the forums or leave a comment for me here. If I find the answer, I'll add it to this post! Thanks!

ColdFusion on IIS7

bills — Tue, 06 Mar 2007 15:42:00 GMT

Back in the early nineties, one of the first scripting languages I learned to build web applications with was ColdFusion. It was a lot of fun! In some ways it is a great way to build your first web site since it is so simple, so much like HTML, yet very powerful. I'm sure ColdFusion has come a long way since I first used it.

In June of 2005 I was invited to give a keynote at CFUnited, one of the premier ColdFusion conferences around. It was a fun, and early preview of ColdFusion running on early alpha builds of IIS7. I remember hacking the frankenstein build together with a few private fixes from the dev team, and some custom tweaks to the configuration system, and then holding my breath as I went on stage to show off how some of the new, cool capabilities of IIS7 we were dreaming could help ColdFusion developers. Luckily, all the demos worked and the talk went off without a hitch.

Fast forward almost two years, and it is fun to see ColdFusion developers getting the product in Vista and writing about it. If you are looking for more information on how to get ColdFusion running on Vista and IIS7, check out this article: http://www.communitymx.com/content/article.cfm?cid=224AA by Heidi Bautista. It provides a great step-by-step overview of how to get rocking on IIS7.

loadUserProfile and IIS7 - understanding temporary directory failures

bills — Wed, 18 Oct 2006 15:47:00 GMT

I've noticed quite a few people running into temporary directory permission issues. The PHP blog post I made last month is one example of this issue, there are also several forum posts related to ASP & Access database failures, where the reported failure is:

Microsoft JET Database Engine error '80004005'
Unspecified error

Not a very helpful error, to be sure. It turns out all of these cases have a similar underlying cause: the effective user of the web application (including the anonymous user for unauthenticated requests) can not effectively write to the temporary directory. What changed in IIS7 and why did this always work before?

With IIS6, all worker processes, regardless of which the process identity was configured, used to C:\windows\temp as the temporary directory. More specifically, none of the worker processes loaded their 'user profile' by default, causing all of them to use c:\windows\temp as a temporary directory. Windows allows all users read/write/creator privledges on this directory, which allowed things to 'just work'. The negative side effect of this is that all AppPools are effectively sharing the same temporary directory by default, which could lead to cross-appPool information disclosure.

With IIS7, we've chosen a more secure default and now load user profile by default for all application pools. Unfortunately, the temporary directory underneath the user directory (for example - %windir%\serviceprofiles\networkservice\AppData\Local\Temp for the default NetworkService identity we use for DefaultAppPool) is not writable by anyone other than NetworkService by default.

There are two ways to workaround this. First, I recommend that ACL the NetworkService temporary directory to allow whichever users read/write/creator privs that you want to allow access so that you still have the benefits of loading a user profile and separating temp directories per appPool. This can easily be done on the command line like this:

icacls %windir%\serviceprofiles\networkservice\AppData\Local\Temp /grant Users:(CI)(S,WD,AD,X)

icacls %windir%\serviceprofiles\networkservice\AppData\Local\Temp /grant "CREATOR OWNER":(OI)(CI)(IO)(F)

This allows every user to create files and directories (WD = Write to Directory, AD = Add Directory, X = Execute, S = Synchronize). The user who creates them will be the “CREATOR OWNER” of the file/directory.

The “CREATOR OWNER” ACE allows this user to do whatever he wants with the file. Other users can’t access these files/directories because they are not “CREATOR OWNER” of them.

The other less favorable workaround is to disable the loadUserProfile setting on a per-appPool basis. loadUserProfile is a boolean property on an AppPool section, and can easily be set on the command line (for defaultAppPool) like this:

%windir%\system32\inetsrv\appcmd set config -section:applicationPools /[name='DefaultAppPool'].processModel.loadUserProfile:false

hope this helps -

bill

Using Visual Web Developer with IIS7

bills — Mon, 18 Sep 2006 23:42:00 GMT

I've been using the free version of Visual Studio for web development - Visual Web Developer Express Edition - for a while now and I really like it. In my opinion it is leagues ahead of previous Visual Studio releases targeted at Web development. I still can't get that nasty taste of Visual Interdev v1 out of my mouth. ;)

Anyway, Bradley, from the Visual Web Developer team, just posted a few tips for getting Visual Web Developer working with Vista RC1 and IIS7. See his post here: http://blogs.msdn.com/webdevtools/archive/2006/09/18/761206.aspx

Thanks Bradley!