While moving my ASP.Net application from Windows 2003 server to Windows 2008 R2 server I ran into following exception when I tried to access the application.

Well this took me by surprise a little because this application has been working for over a year on Windows 2003 server. I remembered that since this was child application under parent DNN portal, I had to add following entry in web.config. From being a child application means that my application was configured as another web application under DNN web application.

<location path="" inheritInChildApplications="false" >

So my first thought based on the exception details was that probably by mistake somebody removed that entry. Well that was not the case. Then I checked the application pool for parent as well as child application. They both were configured to use application pool that was using .Net 4.0 with classic pipe line. Then I looked at compiler options in my child application. It was set as follows and nothing seemed to be wrong here as well.

<compilation debug="true" targetFramework="4.0" />

Only place left was to check in parent application. After digging through million entries in DNN web.config file, I found the following that had compiler option set to V3.5.

<compiler language="vb;vbs;visualbasic;vbscript" 
type="Microsoft.VisualBasic.VBCodeProvider, System, Version=2.0.0.0, 
Culture=neutral, PublicKeyToken=b77a5c561934e089" extension=".vb" warningLevel="4">
   <providerOption name="CompilerVersion" value="v3.5" />
   <providerOption name="OptionInfer" value="true" />
   <providerOption name="WarnAsError" value="false" />
</compiler>
<compiler language="c#;cs;csharp" 
extension=".cs" type="Microsoft.CSharp.CSharpCodeProvider,System, 
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" warningLevel="4">
   <providerOption name="CompilerVersion" value="v3.5" />
   <providerOption name="WarnAsError" value="false" />
</compiler>

After I changed the compiler version to V4.0, my application was happy as a pie! Here is link to Microsoft document on breaking changes that describes this issue in more detail.

After I wrote my post on How to block or unblock IP address in IIS programatically using .Net, I got few questions from users about having some difficulty on Windows 7. All the questions were related to the following line of code.

var ipSecuritySection = hostConfig.GetSection("system.webServer/security/ipSecurity", site);

GetSection method was either returning null object or throwing exception. This indicated that the specified section did not exist in IIS configuration on the machine. And there is a valid reason for it. On Windows 7, IPSecurity section is not enabled in IIS. First indication of this problem is that you will not see IP Address and Domain Restrictions icon in IIS feature view in IIS management console.

Goto Console Panel > Programs > Turn windows features on or off panel. Under IIS > World Wide Web Services > Security you will find IPSecurity section that is not checked. Check it and apply the change and then you should be all set.

In my earlier post How to get list of applications in IIS programatically using .Net, I discussed how to automate IIS management using managed API. One of the common task or action that lot of applications perform is block or unblock IP addresses of users that may be violating some rules or trying to attack your site. Here is code sample that will answer following questions.

• How to block an IP addreess in IIS using .Net?
• How to unblock an IP address in IIS using .Net?

static void BlockIpAddress(string site, string ip)
{
   var serverManager = new ServerManager();
   var hostConfig = serverManager.GetApplicationHostConfiguration();
   // Get ipSecurity section in configuration.
   var ipSecuritySection = hostConfig.GetSection("system.webServer/security/ipSecurity", site);
   var configElements = ipSecuritySection.GetCollection();
   // Check if this ip address is already blocked.
   var ipExists = false;
   foreach (var elem in configElements)
   {
     if (elem.ElementTagName == "add")
     {
        var ipaddr = elem.Attributes["ipAddress"];
        if (null == ipaddr)
        {
           continue;
        }
        if (ipaddr.Value == ip)
        {
          // Check value of "allowed" attribute.
          if ((bool)elem.Attributes["allowed"].Value == true)
          {
           // Simple change this attribute to false and we are done.
           elem.Attributes["allowed"].Value = false;
           break;
          }
        }
      }
    }
    if (!ipExists)
    {
       // Create new element and add it to collection.
       var newElement = configElements.CreateElement("add");
       newElement.Attributes["ipAddress"].Value = ip;
       newElement.Attributes["allowed"].Value = false;
       configElements.Add(newElement);
    }

    serverManager.CommitChanges();
 }

In this series of posts I will discuss automation of IIS7 tasks that you usually perform using IIS Management console. Lot of time there are tasks that you want to perform programatically in response to some events that occur in your application. For example based on some rogue actions being performed by a user or group of users, you want to add their IP addresses added to block list or change behavior of application etc. So having an API provides lot of help in those cases.

Microsoft provides a very nice set of managed API that ease development of automation scripts for IIS7 and higher. So these posts are geared towards getting you started with writing automation scripts for IIS on Windows 7 and Windows 2008.

Simple way to get started with this is to create a console application in Visual Studio 2010. You can use earlier version of Visual Studio as well. Since I am using VS2010, I will just refer to that only. You are going to use Microsoft.Web.Administration namespace. You are going to need to add reference to Microsoft.Web.Administration.dll in your project.

Where is Microsoft.Web.Administration.dll

When you bring up Add Reference dialog box in visual studio, you will not see this assembly in list of .Net assembly list. This does not mean that it is not a managed assembly. It is that you will have to browse to this assembly in folders. You can find this assembly in \Windows\System32\inetsrv folder. So browse to it and add the reference in your project.

Get List Of Applications

Just to get started with IIS7 managed api code development, I wrote a simple method that will list of all applications in my IIS. Following code snippet shows how I did it. So this code answers the following question for automation script writers.

• How to get list of applications in IIS using .Net

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using Microsoft.Web.Administration;

namespace IISManager
{
 class Program
 {
   static void Main(string[] args)
   {
     GetApplicationAttributes();
   }

   static void GetApplicationAttributes()
   {
      var serverManager = new ServerManager();
      foreach (var site in serverManager.Sites)
      {
        Console.WriteLine("Site: {0}", site.Name);
        foreach (var app in site.Applications)
        {
          Console.WriteLine(app.Path);
        }
      }
   }
 }
}

Pretty simple and straight forward. Path property on Application object is actually the alias that you specified when creating the application in IIS Management Console. IIS uses this alias as path when walking the list of applications. So if you look at the printing text for path you notice a leading \. This shows that the alias is relative path.

This morning I was debugging an ASP.Net application my new shiny Windows 7 x64 machine. Moment I launched default page of the application, none of the images were showing up. They were all broken link images on the page. I looked in handy web traffic analysis tool Fiddler. Each of the image requests were coming back with 404 status code. Well that did not make sense because image files were right there where they were supposed to be. Only thing that came to mind at that time was that web server is refusing to serve image files. Then it occurred to me that this a brand new machine that I configured and probably did not configure IIS correctly yet. So I went to Start > Control Panel > Turn Windows Feature On or Off and there it was under IIS that Static Content was disabled. Turn that on and I was all set to go.

This morning I was upgrading an existing ASP.Net application on Windows 2008 R2 server. Previously it was using an application pool that was using ASP.Net 2.0 framework. Since I had compiled the application with .Net 4.0 framework, I need to switch in IIS 7.5 for application to use application pool for ASP.Net 4.0. As soon as I switched to using ASP.Net 4.0 framework in application pool, I got the following error.

404 - File or directory not found.
The resource you are looking for might have been removed, 
had its name changed, or is temporarily unavailable.

That did not make sense for a moment because I was just using the web application and how can I get 404 error just by switching ASP.Net version in application pool. After digging around in Microsoft Knowledge base and IIS7 documentation, I found that the issue is related to ISAPI filter for ASP.Net 4.0 not being enabled in IIS. Here is what you need to do see what is enabled and what is not enabled for ISAPI and CGI in your server.

From IIS Manager, click on top node of your server in left pane. You will see feature view as shown in the image below.

You can see that only ISAPI filters enabled for my server are for ASP.Net 2.0. The ones for ASP.Net 4.0 are not available. Just enabled those for ASP.Net 4.0 and you should be all set to roll.

Other day I was installing a DotnetNuke site on Windows 2008 R2 server. I followed all the usual steps of creating a new web site in IIS7.5 on Windows 2008. When I tried to access the site, I ended up with the following error.

HTTP Error 401.3 - Unauthorized

You do not have permission to view this directory or page because of the access control list (ACL) configuration or encryption settings for this resource on the Web server.

In the past I had run into this problem and I knew that it has something to do with application pool and accounts associated with that pool. The error message clearly tells that it has something to do with file permissions on the folder where the web site was physically present. Here are some of the common causes of this sort of error when you configure a new web site on Windows 2008 IIS7.5.

Check Application Pool

Most important is that you need to check what Application Pool is being used for your site and make sure that that account being used by that pool has appropriate access rights on the folders and files. In Windows 2008 R2 there are some important changes related to accounts that are used for IIS application pools. Most of us who come to Windows 2008 R2 environment, get stumped by the fact that it may not be Network Service account that is used for your web site process.

First thing first, we need to figure out what application pool we are using and how we can change it. Here are my earlier posts where I described these steps.

• How to find Application Pool Of web site on Windows 7
• How to configure Application Pool in IIS in Windows 7

Security Account Used By Application Pool

This piece of information is at heart of solving the error with access control list. When you bring up advanced settings dialog box for the application pool, you will find the following value that tells you the account used by your application pool.

Select the button next to that name and it will bring up following diaolog box where you can change the account settings for your pool identity. You can select system defined accounts from the dropdown or you can select a custom account that you have created for your site.

Diagnosing The Error

So far I have discussed cause and remedies of the error that you got. Now let's see how you can diagnose the issue to really find out what account was trying to access the site files that ended up in access denied error.

I always keep my super tool Process Monitor tool handy on all my development as well as production servers. You can download it from SysInternals site. Fir it up and acces the site. After you get the error, capture the trace and then look for ACCESS DENIED error. I will not go into details about how to effectively use this tool with filters and all to get to the correct information quickly. There you will be able to see windows account that was trying to access the files. Now you can go to site fclder and configure appropriate access rights for the account and you are good to go!

In earlier post I discussed how to find application pool of your web site or web application in Windows 7 and Windows 2008. Next set of questions that I get asked right off the bat are:

• Where are all applicaton pool in IIS in Windows 7 and Windows 2008?
• How to change settings of an application pool in IIS in Windows 7 and Winds 2008?

Here is step by step procedure to find what all application pools you have in IIS7.

• Start IIS Manager console.

• Look in the tree in left hand side pane. There you will find a node named Application Pools. Click on this link.

  

• In the center pane, you will see list of all application pools that have been create on your machine.

  

• Select the pool that you want to inspect or configure. In the right hand pane you will find the list of actions that you can perform on the pool.

  

• Click on Advanced Settings to all the details of your application pool configuration. This is where you can make changes to pool configuration.

  

In IIS7 and higher one of crucial points in web site configuration is Application Pool. A lot of developers who are new to IIS7 and higher IIS management console, ask a very basic question, How do I find Application Pool for the site?. Here is answer to this question.

• Bring up IIS Managager console from Administrative tools.

• Select the web site or web application, for which you find to configure Application Pool, in left hand side pane.

• In the right hand side pane, click on Basic Settings link.

• It will bring up following view, where you can see your application pool for your web application.

  

• Click on Select button if you want to see all the pools that are available to you. This is where you can change Application Pool for your application.

When moving applications from Windows XP or Windows 2003 to newer platforms like Windows 7 or Windows 2008, one of the questions that I see coming to me is "my HttpModules are not getting called" or "my break point in HttpModule is not working". Well, one of the things that most ASP.Net developers forget is that there have been lot of changes made from IIS6 to IIS7 and higher. And one of the major and significant change is use of Integrated Pipe Line. What this means is that ASP.Net becomes part of the web server call flow and not an ISAPI extension invoked to run ASP.Net worker process. I am not going to go in much details about this. In this post I am going to address some of most commonly asked questions about HttpModule when applications are migrated to IIS7 or higher.

• HttpModule not getting called
• HttpModule not loaded
• Break point not hitting in HtppModule

Here are steps you can follow to diagnose these issues and fix them.

Check application pool

First step is to check application pool being used by your ASP.Net application in IIS7 or higher. Here are steps to follow to check the application pool.

• Launch IIS manager and select your application in left pane.

• In the right pane you will see item Basic Settings under Action section at the top.

  >

• Click on Basic Settings and it will bring up dialog box that will show you what application pool is being used by the application.

  

• Click on Select button to get more details about the pool. And you can see from the image below that my application is using .Net 4.0 with Integrate pipe line.

  

Fix Web.config file

The fix for the problem can be at two place. First lets look at fixing web.config file.

Using Integrated Pipe Line

If your application is to use Integrated Pipeline mode then make sure that you have system.webServer section in your config file. This is section that is used to configure HttpModule collection. If your HttpModules are configured in system.web section of web.config file, then you need to move them in this section. Yes, there is no coding change required for the modules. Im my case, the entries look as below.

<system.webServer>
 <validation validateIntegratedModeConfiguration="false"/>
  <modules runAllManagedModulesForAllRequests="true">
   <add name="UrlRewrite" type="BlogEngine.Core.Web.HttpModules.UrlRewrite, BlogEngine.Core"/>
  </modules>
</system.webServer>

Using Classic Mode

If your application is to use Classic mode, then make sure that your application is configured for that type of pool and your modules are configured in system.web section and not in system.webServer section of web.config file.

Fix application pool

Second type of fix is to change application pool of your application if you can not move configuration of modules in web.config file. Depending on your choice of application pool, use appropriate section in config file to add HttpModules.