in

ASP.NET Weblogs

Ambrosian Scripture

Real-world answers to real-world problems.

.NET 1.1 SP1 Killed my ASP.NET

Okay, so like a good Microsoft lover I install the service packs as soon as they're available if not before.  I installed 1.1 SP1 to address a remoting bug.  But now my ASP.NET apps don't run.  I have to ask: Microsoft, where's the love?  I give and give and this is what I get in return!?

Seriously, though, I'm getting Server Application Unavailable and Event Viewer reports:
Event Type:     Error
Event Source:   ASP.NET 1.1.4322.0
Event Category: None
Event ID:       1007
Date:           9/1/2004
Time:           4:11:23 PM
User:           N/A
Computer:       AMBROSE
Description:
aspnet_wp.exe could not be launched because the username and/or password supplied in the processModel section of the config file are invalid.

and

Event Type:     Error
Event Source:   ASP.NET 1.1.4322.0
Event Category: None
Event ID:       1084
Date:           9/1/2004
Time:           4:11:23 PM
User:           N/A
Computer:       AMBROSE
Description:
aspnet_wp.exe could not be started. The error code for the failure is 80004005. This error can be caused when the worker process account has insufficient rights to read the .NET Framework files. Please ensure
that the .NET Framework is correctly installed and that the ACLs on the installation directory allow access to the configured account.

Now, I thought, oh, they just reset the ASPNET account password, and since I'm using the "trusted subsystem model" with mirrored passwords, I have to reset it.  So I went and set the ASPNET account password to the same used in my processModel element.  No dice.

...time flies as I bang my head against a wall thinking "ARGH!  They do too match!!"...

Well, it turns out that the ASPNET account got locked out.  I guess my domain policy here gets applied to local accounts.  I unlocked it and reset IIS, and voila, we're back in business.

Now, wouldn't it be nice if the service pack didn't reset the ASPNET account password?  I think it's pretty safe to assume that someone applying a service pack already has installed ASP.NET, so it is not necessary to reset/recreate that account.  Microsoft, please update your tools to not muck with my settings, especially when they're settings that you recommend in your PAG books.

Published Sep 01 2004, 04:39 PM by Ambrose
Filed under: ,

Comments

 

TrackBack said:

September 1, 2004 6:45 PM
 

Scott Allen said:

Ouch. That is an unfriendly thing to do.
September 1, 2004 9:58 PM
 

Jeffrey Palermo said:

Because of all the concern surrounding SP2 and .Net 1.1, I've intentionally decided to be a late adoptor for these so I can learn from experiences of others and then upgrade when I know the issues. Thanks for the post.
September 2, 2004 9:51 AM
 

TrackBack said:

September 3, 2004 12:03 PM
 

sucks... said:

I had the same prob. It DOES suck to apply PAG practices and run into this isn't it :) Any documentation, warning etc? Nooooooooope. Why should MS bother? Someone will find it out anyway!

That made me realllllyyyy angry, I tell ya pal.
September 6, 2004 4:42 AM
 

max feng said:

Another Problem!

When I installed .NET 1.1 SP1 , my Event Viewer only reports the second message:

Event Type: Error
Event Source: ASP.NET 1.1.4322.0
Event Category: None
Event ID: 1084
Date: 9/6/2004
Time: 9:11:43 PM
User: N/A
Computer: MaxFeng
Description:
aspnet_wp.exe could not be started. The error code for the failure is 80004005. This error can be caused when the worker process account has insufficient rights to read the .NET Framework files. Please ensure
that the .NET Framework is correctly installed and that the ACLs on the installation directory allow access to the configured account.

Neither I set the account ASPNET or some local accounts , aspnet_wp.exe is dead.
How can I do?
September 8, 2004 4:33 AM
 

J. Ambrose Little said:

Max, look in your machine.config file under the processModel element. Ensure that its username is set to "machine" and the password is set to "AutoGenerate" as this means that it is set up with the defaults.

If you've done that, and it's still not working, try running aspnet_regiis.exe from the 1.1 framework directory and restarting IIS. This should sync up the ASPNET password.

If it still doesn't work, you maybe modified the default permissions for the ASPNET account, so look at this KB article for info on the perms it needs:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q317012#4

If you're on a domain controller, look at this article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;315158

If you're still stuck, try asking in the ASP.NET Forums (http://www.asp.net/Forums).
September 8, 2004 12:08 PM
 

John said:

I just gave aspnet full access to the c drive and it worked. It's not the best approach, I know, but I was tired of the problem.
September 9, 2004 6:27 AM
 

Peixin Han said:

Hi, Ambrose,

Thanks very much for your feedback about the aspnet password reset! From a security standpoint, we think it is good to change the password of the ASPNET account periodically. So each time the product is installed, we will reset the password for ASPNET account. In your case, we recommand to create a new account instead of changing the ASPNET account.

We are working to get a KB article published for this ASAP. Again thanks very much for helping us improving our product.

-Peixin

September 9, 2004 1:50 PM
 

J. Ambrose Little said:

Peixin,

Thanks for responding and for building a KB article about this.

I have to say, however, that I do not think that you guys should ever reset the ASPNET password for service packs precisely because it is a given that the user has already installed and, possibly, configured it differently.

Yes, changing the password occassionally is a good idea, but this should not be done automagically by your tools.

Sure, I could use a different account for the trusted subsystem model, but even the PAG documents recommend using this account in this way.

The following is from Chapter 8 of Building Secure ASP.NET Applications (online at http://tinyurl.com/697m8).

Under the "Using the Default ASPNET Account" section:
"The local ASPNET account has been configured specifically to run ASP.NET Web applications with the minimum possible set of privileges. Use ASPNET whenever possible."

Also, in chapter 5, there's a section called "Configuring ASP.NET" that details how to set up the ASPNET account using the trusted subsystem model (also recommended).

Again, my point here is that PAG recommends the use of the ASPNET account in general and specifically details how to set it up for the trusted subsystem model, which also is highly recommended by them. Therefore, Microsoft's updates should not go against its own patterns & architecture group's recommendations, causing problems for users who are following their recommendations.

I'm not out to get you, but I do request that in the future you guys do not do this. Thanks.
September 9, 2004 2:26 PM
 

Stephen’s Personal Blog » Blog Archive » ASPNET Problem: Server Application Unavailable said:

PingBack from http://stephensite.net/WordPressSS/?p=114

January 9, 2007 9:28 AM

Leave a Comment

(required)  
(optional)
(required)  
Add
Terms of Use