Welcome to MobyThreads.com!
FAQFAQ      ProfileProfile    Private MessagesPrivate Messages   Log inLog in
All support for the MobyThreads Threaded phpBB MOD can now be found on welsolutions at this forum

401.3 When Accessing Remote UNC Share

 
   Web Hosting and Web Master Forums (Home) -> IIS RSS
Next:  Determine if WebDav is enabled.  
Author Message
GTUser

External


Since: Oct 27, 2007
Posts: 3



(Msg. 1) Posted: Sat Oct 27, 2007 4:03 am
Post subject: 401.3 When Accessing Remote UNC Share
Archived from groups: microsoft>public>inetserver>iis (more info?)

I've been trying to figure out the following issue for a few days with
no luck. There are two servers involved, both are standalone servers
(no domain):

WebServer - Windows 2003 R2
FileServer - Windoows 2000 SP4

>From the WebServer i've created a new Virtual Directory, and specified
a UNC path on the FileServer. I then specify an Account to use when
accessing the UNC. This account exists on both the WebServer and
FileServer with the same password. Accessing the UNC from Windows
Explorer works flawless. Trying to access the UNC though a browser
results in the following:

If the UNC Username and password has no prefix, I get error 500
If I specify \\WebServer\Username along with the password I get a
401.3 error
If I specify \\FileServer\Username along with the password I get
another error 500

I've verified that the UNC username exists in the Metabase. If I
disable the UNC username/password, and check the both to use the
current credentials (with basic Authentication checked) I am prompted
with a login screen. Entering the account in there (or even one of
the admin accounts) results in a 401.3 error after a few attempts.

Using the exact same credentials to access the file share from outside
IIS is working. I'm stuck for ideas, as neither computer is in a
domain so Delegation can't be an issue. Is there something simple i'm
missing?

 >> Stay informed about: 401.3 When Accessing Remote UNC Share 
Back to top
Login to vote
GTUser

External


Since: Oct 27, 2007
Posts: 3



(Msg. 2) Posted: Sat Oct 27, 2007 4:03 am
Post subject: Re: 401.3 When Accessing Remote UNC Share [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

On Oct 27, 12:51 am, GTU... RemoveThis @hush.com wrote:
> I've been trying to figure out the following issue for a few days with
> no luck. There are two servers involved, both are standalone servers
> (no domain):
>
> WebServer - Windows 2003 R2
> FileServer - Windoows 2000 SP4
>
> >From the WebServer i've created a new Virtual Directory, and specified
>
> a UNC path on the FileServer. I then specify an Account to use when
> accessing the UNC. This account exists on both the WebServer and
> FileServer with the same password. Accessing the UNC from Windows
> Explorer works flawless. Trying to access the UNC though a browser
> results in the following:
>
> If the UNC Username and password has no prefix, I get error 500
> If I specify \\WebServer\Username along with the password I get a
> 401.3 error
> If I specify \\FileServer\Username along with the password I get
> another error 500
>
> I've verified that the UNC username exists in the Metabase. If I
> disable the UNC username/password, and check the both to use the
> current credentials (with basic Authentication checked) I am prompted
> with a login screen. Entering the account in there (or even one of
> the admin accounts) results in a 401.3 error after a few attempts.
>
> Using the exact same credentials to access the file share from outside
> IIS is working. I'm stuck for ideas, as neither computer is in a
> domain so Delegation can't be an issue. Is there something simple i'm
> missing?

Incidentally, a ProcessMon reveals the following:

Access Denied when trying to access \\FileServer\Share. Going deeper
it shows the impersonating account as \\WebServer\User, and the User
under process as "NT Authority\System" (App Pool is using Local System
for troubleshooting).

Is the fact that the account appears to be impersonated causing any
issues?

 >> Stay informed about: 401.3 When Accessing Remote UNC Share 
Back to top
Login to vote
Steve Schofield

External


Since: Sep 27, 2007
Posts: 32



(Msg. 3) Posted: Sat Oct 27, 2007 4:03 am
Post subject: Re: 401.3 When Accessing Remote UNC Share [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

Impersonation uses the IUSR account (anonymous). if not, the application
pool user is used. You need to have either network service, then grant the
calling web service account access to the content or use a custom user. As
far as I know, SYSTEM won't work. I've never tested SYSTEM as the app pool
user and UNC content.

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technol...es/weba


--

Best regards,

Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield

http://www.IISLogs.com
Log archival solution.
Install, Configure, Forget

<GTUser.TakeThisOut@hush.com> wrote in message
news:1193466404.468669.272300@d55g2000hsg.googlegroups.com...
> On Oct 27, 12:51 am, GTU....TakeThisOut@hush.com wrote:
>> I've been trying to figure out the following issue for a few days with
>> no luck. There are two servers involved, both are standalone servers
>> (no domain):
>>
>> WebServer - Windows 2003 R2
>> FileServer - Windoows 2000 SP4
>>
>> >From the WebServer i've created a new Virtual Directory, and specified
>>
>> a UNC path on the FileServer. I then specify an Account to use when
>> accessing the UNC. This account exists on both the WebServer and
>> FileServer with the same password. Accessing the UNC from Windows
>> Explorer works flawless. Trying to access the UNC though a browser
>> results in the following:
>>
>> If the UNC Username and password has no prefix, I get error 500
>> If I specify \\WebServer\Username along with the password I get a
>> 401.3 error
>> If I specify \\FileServer\Username along with the password I get
>> another error 500
>>
>> I've verified that the UNC username exists in the Metabase. If I
>> disable the UNC username/password, and check the both to use the
>> current credentials (with basic Authentication checked) I am prompted
>> with a login screen. Entering the account in there (or even one of
>> the admin accounts) results in a 401.3 error after a few attempts.
>>
>> Using the exact same credentials to access the file share from outside
>> IIS is working. I'm stuck for ideas, as neither computer is in a
>> domain so Delegation can't be an issue. Is there something simple i'm
>> missing?
>
> Incidentally, a ProcessMon reveals the following:
>
> Access Denied when trying to access \\FileServer\Share. Going deeper
> it shows the impersonating account as \\WebServer\User, and the User
> under process as "NT Authority\System" (App Pool is using Local System
> for troubleshooting).
>
> Is the fact that the account appears to be impersonated causing any
> issues?
>
 >> Stay informed about: 401.3 When Accessing Remote UNC Share 
Back to top
Login to vote
GTUser

External


Since: Oct 27, 2007
Posts: 3



(Msg. 4) Posted: Sat Oct 27, 2007 9:28 am
Post subject: Re: 401.3 When Accessing Remote UNC Share [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

On Oct 27, 2:17 am, "Steve Schofield" <st....RemoveThis@iislogs.com> wrote:
> Impersonation uses the IUSR account (anonymous). if not, the application
> pool user is used. You need to have either network service, then grant the
> calling web service account access to the content or use a custom user. As
> far as I know, SYSTEM won't work. I've never tested SYSTEM as the app pool
> user and UNC content.
>
> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/techno...
>
> --
>
> Best regards,
>
> Steve Schofield
> Windows Server MVP - IIShttp://weblogs.asp.net/steveschofield
>
> http://www.IISLogs.com
> Log archival solution.
> Install, Configure, Forget
>
> <GTU....RemoveThis@hush.com> wrote in message
>
> news:1193466404.468669.272300@d55g2000hsg.googlegroups.com...
>
>
>
> > On Oct 27, 12:51 am, GTU....RemoveThis@hush.com wrote:
> >> I've been trying to figure out the following issue for a few days with
> >> no luck. There are two servers involved, both are standalone servers
> >> (no domain):
>
> >> WebServer - Windows 2003 R2
> >> FileServer - Windoows 2000 SP4
>
> >> >From the WebServer i've created a new Virtual Directory, and specified
>
> >> a UNC path on the FileServer. I then specify an Account to use when
> >> accessing the UNC. This account exists on both the WebServer and
> >> FileServer with the same password. Accessing the UNC from Windows
> >> Explorer works flawless. Trying to access the UNC though a browser
> >> results in the following:
>
> >> If the UNC Username and password has no prefix, I get error 500
> >> If I specify \\WebServer\Username along with the password I get a
> >> 401.3 error
> >> If I specify \\FileServer\Username along with the password I get
> >> another error 500
>
> >> I've verified that the UNC username exists in the Metabase. If I
> >> disable the UNC username/password, and check the both to use the
> >> current credentials (with basic Authentication checked) I am prompted
> >> with a login screen. Entering the account in there (or even one of
> >> the admin accounts) results in a 401.3 error after a few attempts.
>
> >> Using the exact same credentials to access the file share from outside
> >> IIS is working. I'm stuck for ideas, as neither computer is in a
> >> domain so Delegation can't be an issue. Is there something simple i'm
> >> missing?
>
> > Incidentally, a ProcessMon reveals the following:
>
> > Access Denied when trying to access \\FileServer\Share. Going deeper
> > it shows the impersonating account as \\WebServer\User, and the User
> > under process as "NT Authority\System" (App Pool is using Local System
> > for troubleshooting).
>
> > Is the fact that the account appears to be impersonated causing any
> > issues?- Hide quoted text -
>
> - Show quoted text -

Thanks Steve, but i've tried using the Generic App Pool with the same
results. I'm specifying the credentials in the properties of the
Virtual Directory where it allows me to always use a specific user,
additionally i've granted these rights on the destination UNC share.

Is there anything else I need to do? Should is matter that a
processMon shows that i'm trying to access the remote share as WebUser
\Username and not FileServer\Username? Netmon shows that the request
is making it to the FileServer, but i'm not sure if IIS is passing the
correct credentials, or why i'm getting an access denied error. Is
there anything equivalent to delegation that needs to be turned on in
a non-domain?
 >> Stay informed about: 401.3 When Accessing Remote UNC Share 
Back to top
Login to vote
Steve Schofield

External


Since: Sep 27, 2007
Posts: 32



(Msg. 5) Posted: Mon Oct 29, 2007 1:09 pm
Post subject: Re: 401.3 When Accessing Remote UNC Share [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

Take a look at the article I wrote, maybe it'll point you in the right
direction. Running Filemon on the web server and remote file server can
help determine if there is a NTFS folder issue. Make sure the Share
permissions are setup correctly or this could prohibit it from working.

http://iislogs.com/articles/23/

--

Steve Schofield
Windows Server MVP - IIS
http://weblogs.asp.net/steveschofield

<GTUser DeleteThis @hush.com> wrote in message
news:1193502532.424008.260390@v3g2000hsg.googlegroups.com...
> On Oct 27, 2:17 am, "Steve Schofield" <st... DeleteThis @iislogs.com> wrote:
>> Impersonation uses the IUSR account (anonymous). if not, the application
>> pool user is used. You need to have either network service, then grant
>> the
>> calling web service account access to the content or use a custom user.
>> As
>> far as I know, SYSTEM won't work. I've never tested SYSTEM as the app
>> pool
>> user and UNC content.
>>
>> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/techno...
>>
>> --
>>
>> Best regards,
>>
>> Steve Schofield
>> Windows Server MVP - IIShttp://weblogs.asp.net/steveschofield
>>
>> http://www.IISLogs.com
>> Log archival solution.
>> Install, Configure, Forget
>>
>> <GTU... DeleteThis @hush.com> wrote in message
>>
>> news:1193466404.468669.272300@d55g2000hsg.googlegroups.com...
>>
>>
>>
>> > On Oct 27, 12:51 am, GTU... DeleteThis @hush.com wrote:
>> >> I've been trying to figure out the following issue for a few days with
>> >> no luck. There are two servers involved, both are standalone servers
>> >> (no domain):
>>
>> >> WebServer - Windows 2003 R2
>> >> FileServer - Windoows 2000 SP4
>>
>> >> >From the WebServer i've created a new Virtual Directory, and
>> >> >specified
>>
>> >> a UNC path on the FileServer. I then specify an Account to use when
>> >> accessing the UNC. This account exists on both the WebServer and
>> >> FileServer with the same password. Accessing the UNC from Windows
>> >> Explorer works flawless. Trying to access the UNC though a browser
>> >> results in the following:
>>
>> >> If the UNC Username and password has no prefix, I get error 500
>> >> If I specify \\WebServer\Username along with the password I get a
>> >> 401.3 error
>> >> If I specify \\FileServer\Username along with the password I get
>> >> another error 500
>>
>> >> I've verified that the UNC username exists in the Metabase. If I
>> >> disable the UNC username/password, and check the both to use the
>> >> current credentials (with basic Authentication checked) I am prompted
>> >> with a login screen. Entering the account in there (or even one of
>> >> the admin accounts) results in a 401.3 error after a few attempts.
>>
>> >> Using the exact same credentials to access the file share from outside
>> >> IIS is working. I'm stuck for ideas, as neither computer is in a
>> >> domain so Delegation can't be an issue. Is there something simple i'm
>> >> missing?
>>
>> > Incidentally, a ProcessMon reveals the following:
>>
>> > Access Denied when trying to access \\FileServer\Share. Going deeper
>> > it shows the impersonating account as \\WebServer\User, and the User
>> > under process as "NT Authority\System" (App Pool is using Local System
>> > for troubleshooting).
>>
>> > Is the fact that the account appears to be impersonated causing any
>> > issues?- Hide quoted text -
>>
>> - Show quoted text -
>
> Thanks Steve, but i've tried using the Generic App Pool with the same
> results. I'm specifying the credentials in the properties of the
> Virtual Directory where it allows me to always use a specific user,
> additionally i've granted these rights on the destination UNC share.
>
> Is there anything else I need to do? Should is matter that a
> processMon shows that i'm trying to access the remote share as WebUser
> \Username and not FileServer\Username? Netmon shows that the request
> is making it to the FileServer, but i'm not sure if IIS is passing the
> correct credentials, or why i'm getting an access denied error. Is
> there anything equivalent to delegation that needs to be turned on in
> a non-domain?
>
 >> Stay informed about: 401.3 When Accessing Remote UNC Share 
Back to top
Login to vote
Display posts from previous:   
Related Topics:
accessing share from isapi - I try to access share on another computer from ISAPI dll. I have the share mapped on the server. If I call the dll from IE running on the server where IIS 5 runs, it works. If I try it using IE on another computer, it says Invalid file handle. With IIS ...

Accessing a network share when connected via https - I'm using network load balancing and IIS 6.0. The application is set up to use anonymous authentication with the anonymous user being a domain account. A couple of pages in the app allow files to be uploaded to the server. Right now the files are..

IIS 5.0 and Remote Share - What we have IIS Windows 2000 SP4 ASP.net v1.1.4322 Virtual Site set to use windows authentication. When we go to our site the user information is being passed to the sql box, but when we try to access a remote share through our asp script We get ..

remote share with asp.net 2.0 - I have a installation with a win 2000 sp 4 machine with IIS serving the web. I created a site on it with a remote share to a directory on windows 2003 machine. I cannot get this cofig to work. I tried adding a codegroup for the remote share to teh ....

.NET user identity when accessing files on a network share.. - Hi, We have set up a development environment based on a single network file server and multiple web servers. The file server is in domain 'Domain1' and web servers are in 'Domain2', so various things can be changed in AD. Every web server has a few..
   Web Hosting and Web Master Forums (Home) -> IIS All times are: Pacific Time (US & Canada) (change)
Page 1 of 1

 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



[ Contact us | Terms of Service/Privacy Policy ]