dllhost.exe Access Denied

WenJun -

Thanks for your prompt response.

I found that this issue was caused by a GPO that was applied to this server
late last week which defined the "Bypass traverse checking" right to a
Domain level server admin group and local administrators only. This GPO was
assigned to all my servers. When I removed the recently added GPO for the
server having the problem and the SUSAdmin page could be viewed, so I knew
it was related to the GPO.

The reason my other servers continued to function was an ACE defined on the
WINNT\Temp folder which granted "Traverse Folder/Execute File", "Create
Files/Write Data" and "Create Folders/Append Data" to the local Users group
on all the servers that continued to function. This ACE did not exist on
the server with the issue, so I added the ACE and re-applied the GPO. The
SUSAdmin page continued to function normally.

Your final suggestion about double-checking the 'Bypass traverse checking'
right did the trick.

Thanks for your help!

-Rob

""WenJun Zhang[msft]"" <v-wzhang.DeleteThis@online.microsoft.com> wrote in message
news:3vzbsEr9DHA.3736@cpmsftngxa07.phx.gbl...
 > Hi Rob,
 >
 > Please first test to run this site in IIS process to see if it is
 > able to work, this lauches the site under System account but not IWAM:
 > In IIS mmc, right-click the Default Web Site->SUSAdmin vdir and open
 > its properties.
 > In the Virtual Directory dialog, set Application Protection to Low
 > (IIS Process).
 > Run iisreset command in Start->Run to restart IIS. Then please test
 > the SUS site again and if it still fails, check event log to see if
 > there is any new error log.
 >
 > If you hope to deeply troubleshoot the IWAM error, please change the
 > setting back and download filemon from:
<font color=purple> > <a style='text-decoration: underline;' href="http://www.sysinternals.com/ntw2k/source/filemon.shtml</font" target="_blank">http://www.sysinternals.com/ntw2k/source/filemon.shtml</font</a>>
 > Only include dllhost.exe in filemon's toolbar->filter. Then browse to
 > the SUS site to reproduce the error and check if this generates any
 > access denied events in filemon.
 > It is also possible that the permission is denied in registry, you
 > may perform test with regmon in the same way:
<font color=purple> > <a style='text-decoration: underline;' href="http://www.sysinternals.com/ntw2k/source/regmon.shtml.</font" target="_blank">http://www.sysinternals.com/ntw2k/source/regmon.shtml.</font</a>>
 >
 > Furthermore, in Administrative Tools->Local Security Policy->Local
 > Policies->User Rights Assisgnment, check if IWAM account has been
 > granted with the 'Bypass traverse checking' right. By default, the
 > local Everyone group has this permission.
 >
 > Please update here on any results or progress.
 > Have a nice day,
 >
 > WenJun Zhang
 > Microsoft Online Support
 > This posting is provided "AS IS" with no warranties, and confers no
 > rights.
<font color=purple> > Get Secure! - <a style='text-decoration: underline;' href="http://www.microsoft.com/security</font" target="_blank">www.microsoft.com/security</font</a>>
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: dllhost.exe Access Denied