Thursday, March 3, 2016

Recent windows security update break iis anonymous authentication

After a recent windows update (2016/02), few asp.net apps on iis get an Access is denied error.
The detailed error information is shown as

Description: An error occurred while accessing the resources required to serve this request. You might not have permission to view the requested resources. 

Error message 401.3: You do not have permission to view this directory or page using the credentials you supplied (access denied due to Access Control Lists). Ask the Web server's administrator to give you access to 'C:\SharedFolder\I826633@git\tools\Cache\Cache\'.


Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.114.0

In order to fix the issue, open iis administration console, and select the virtual directory of the asp.net app, right click on the anonymous authentication item, and select edit. Then change anonymous user identity from specific usre of "IUSR" to "Application pool identity"

1 comment:

  1. The real question is, 'Which Windows update did this'? We have had this happen to one of our IIS servers either yesterday or early this morning. We corrected as indicated above but it would be nice to know why it happened (which update).

    ReplyDelete