New process started under ASP .NET - Different behavior in IIS 6

[Sorin Dolha [MCSD .NET]]

Hello,

I have an ASP .NET web site (code written in C#), and in one web page's class I wrote code to call the platform function CreateProcessWithLogonW (by interoperating with Windows API) to start an external process and to run it as another user.

The code works great when the site is hosted on my development computer: Windows XP SP1 (all updates applied), IIS 5. However, when I deploy the web site to a test Windows Server 2003 (IIS 6) environment, the external process does not work: the process starts (I can see it running as the required user in the Task Manager window), but an error message: "myapp.exe failed to initialize properly" (error code: c0000142), and then, the process is stopped. The behavior is not process dependent: if I would use cmd.exe or another process instead of myapp.exe, the same would happen: the process starts, but this message appears and then the process is halted.

Myapp.exe functions when it is called from ASP .NET under Windows XP (IIS 5). Also, myapp.exe process does not create any window on the desktop (I know this would cause it not to run properly when started from ASP .NET's process).

Before digging more about this (I didn't found anything in MSDN, so I would need to start searching on the web, whew that will be tough ), I wanted to ask if anyone else from here has already had this problem, and what was the resolution or work-around he or she found. Any other advice would be very appreciated.

Thank you very much,

 

[Abhishek Srivastava]

IIS 6.0 has a concept of worker processes. This is very different from
how IIS 5.0 used to work.

In IIS 6.0 workder processes run under a group called IIS_WPG

So you must edit the security configuration of your server to allow this
group to be able to run processes and be able to read the directory
where the exe is located.

Let me know if this solves the problem.

would need to start searching on the web, whew that will be tough

Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

 

[Martin Dechev]

Hi, Sorin Dolha,

It is not the IIS, neither is your code that causes this error. This error
means that the Windows could not execute the binary.

Greetings
Martin
Hello,

I have an ASP .NET web site (code written in C#), and in one web page's
class I wrote code to call the platform function CreateProcessWithLogonW (by
interoperating with Windows API) to start an external process and to run it
as another user.

The code works great when the site is hosted on my development computer:
Windows XP SP1 (all updates applied), IIS 5. However, when I deploy the web
site to a test Windows Server 2003 (IIS 6) environment, the external process
does not work: the process starts (I can see it running as the required user
in the Task Manager window), but an error message: "myapp.exe failed to
initialize properly" (error code: c0000142), and then, the process is
stopped. The behavior is not process dependent: if I would use cmd.exe or
another process instead of myapp.exe, the same would happen: the process
starts, but this message appears and then the process is halted.

Myapp.exe functions when it is called from ASP .NET under Windows XP (IIS
5). Also, myapp.exe process does not create any window on the desktop (I
know this would cause it not to run properly when started from ASP .NET's
process).

Before digging more about this (I didn't found anything in MSDN, so I would
need to start searching on the web, whew that will be tough ), I wanted
to ask if anyone else from here has already had this problem, and what was
the resolution or work-around he or she found. Any other advice would be
very appreciated.

Thank you very much,

 

[Sorin Dolha [MCSD .NET]]

Abhishek,

Thank you very much for the reply.

I will check it out and come back with details about what happened. I'm not sure, however, what will I need to do to "edit the security configuration" of the server. Do you mean the IIS's MMC configuration window? I will try to find there a place where the worker processes can be configured. (I'm kinda new to Windows Server 2003, I'm sorry if I ask questions with answers that might look very simple for you.)

Thank you again,

--
Sorin Dolha [MCAD, MCSD .NET]
IIS 6.0 has a concept of worker processes. This is very different from
how IIS 5.0 used to work.

In IIS 6.0 workder processes run under a group called IIS_WPG

So you must edit the security configuration of your server to allow this
group to be able to run processes and be able to read the directory
where the exe is located.

Let me know if this solves the problem.

would need to start searching on the web, whew that will be tough

Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

 

[Sorin Dolha [MCSD .NET]]

Martin,

Thank you very much for the reply. However, as I already stated, the error message appears only when the process is run from withing ASP ..NET. The myApp.exe binary file is running correctly when it is run manually. It also runs correctly when it is run from another test-purpose process (a Windows-based application which starts the external process only to test if it works). Therefore, I think that the binary file is ok. Also as I already stated, the same happens if I change MyApp.exe with Cmd.exe.

--
Sorin Dolha [MCAD, MCSD .NET]
Hi, Sorin Dolha,

It is not the IIS, neither is your code that causes this error. This error
means that the Windows could not execute the binary.

Greetings
Martin
Hello,

I have an ASP .NET web site (code written in C#), and in one web page's
class I wrote code to call the platform function CreateProcessWithLogonW (by
interoperating with Windows API) to start an external process and to run it
as another user.

The code works great when the site is hosted on my development computer:
Windows XP SP1 (all updates applied), IIS 5. However, when I deploy the web
site to a test Windows Server 2003 (IIS 6) environment, the external process
does not work: the process starts (I can see it running as the required user
in the Task Manager window), but an error message: "myapp.exe failed to
initialize properly" (error code: c0000142), and then, the process is
stopped. The behavior is not process dependent: if I would use cmd.exe or
another process instead of myapp.exe, the same would happen: the process
starts, but this message appears and then the process is halted.

Myapp.exe functions when it is called from ASP .NET under Windows XP (IIS
5). Also, myapp.exe process does not create any window on the desktop (I
know this would cause it not to run properly when started from ASP ..NET's
process).

Before digging more about this (I didn't found anything in MSDN, so I would
need to start searching on the web, whew that will be tough ), I wanted
to ask if anyone else from here has already had this problem, and what was
the resolution or work-around he or she found. Any other advice would be
very appreciated.

Thank you very much,

 

[Sorin Dolha [MCSD .NET]]

Abhishek,

Thank you for your kind advice; I knew about Google's Groups search, but what I meant was that it would have been a little hard for me to find the good keywords to search for, given that I only had these: "IIS 6, ASP .NET, start process, different behavior, c0000142: Application failed to initialize" You know what I mean...

I also didn't look for IIS 6 Help yet, as I was not sure if that the strange behavior I got was by design or by my mistake. However, now, after receiving certain information from you about IIS 6 worker processes group (IIS_WPG) and staff, I can start searching the web too. The "whew" was because I didn't know what to search for...

Thanks again,

--
Sorin Dolha [MCAD, MCSD .NET]
Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

 

[Sorin Dolha [MCSD .NET]]

Abhishek,

I have managed to configure the IIS_WPG users group to have Full rights on the folder containing MyApp.exe, and then restarted IIS and my web site but the behavior didn't change: the application failed to initialize.

Seeing that, I have added IIS_WPG to local Administrators group just to make sure that a process running under an identity from IIS_WPG can do anything (read, or write any file anywhere, start any processes it wants) on the local test computer. The behavior didn't change: the application failed to initialize.

I will, however, try to find the cause of this annoying problem, and if I manage to do that I'll let you know what was it.

--
Sorin Dolha [MCAD, MCSD .NET]
IIS 6.0 has a concept of worker processes. This is very different from
how IIS 5.0 used to work.

In IIS 6.0 workder processes run under a group called IIS_WPG

So you must edit the security configuration of your server to allow this
group to be able to run processes and be able to read the directory
where the exe is located.

Let me know if this solves the problem.

would need to start searching on the web, whew that will be tough

Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

 

[Abhishek Srivastava]

You said you were using the API call CreateProcessWithLogonW

Can you go into the local security policy, and add IIS_WPG group in "log
on locally" group. Because not only you need permission to read and
execute but to log on as well.

See if that solves the problem.

However, I am afraid that even if this works, we will be creating a
security loophole because ASP.net account should not be allowed to log
on locally....

But just to test.

regards,
Abhishek.

Abhishek,

I have managed to configure the IIS_WPG users group to have Full rights
on the folder containing MyApp.exe, and then restarted IIS and my
web site but the behavior didn't change: the application failed to
initialize.

Seeing that, I have added IIS_WPG to local Administrators group just to
make sure that a process running under an identity from IIS_WPG can do
anything (read, or write any file anywhere, start any processes it
wants) on the local test computer. The behavior didn't change: the
application failed to initialize.

I will, however, try to find the cause of this annoying problem, and if
I manage to do that I'll let you know what was it.

--
Sorin Dolha [MCAD, MCSD .NET]

"Abhishek Srivastava" <[email protected]
IIS 6.0 has a concept of worker processes. This is very different from
how IIS 5.0 used to work.

In IIS 6.0 workder processes run under a group called IIS_WPG

So you must edit the security configuration of your server to allow
this
group to be able to run processes and be able to read the directory
where the exe is located.

Let me know if this solves the problem.

would need to start searching on the web, whew that will be tough

Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

Hello,

I have an ASP .NET web site (code written in C#), and in one web
page's class I wrote code to call the platform function
CreateProcessWithLogonW (by interoperating with Windows API) to start an
external process and to run it as another user.

The code works great when the site is hosted on my development computer:
Windows XP SP1 (all updates applied), IIS 5. However, when I deploy the
web site to a test Windows Server 2003 (IIS 6) environment, the external
process does not work: the process starts (I can see it running as the
required user in the Task Manager window), but an error message:
"myapp.exe failed to initialize properly" (error code: c0000142), and
then, the process is stopped. The behavior is not process dependent: if
I would use cmd.exe or another process instead of myapp.exe, the same
would happen: the process starts, but this message appears and then the
process is halted.

Myapp.exe functions when it is called from ASP .NET under Windows XP
(IIS 5). Also, myapp.exe process does not create any window on the
desktop (I know this would cause it not to run properly when started
from ASP .NET's process).

Before digging more about this (I didn't found anything in MSDN, so I
would need to start searching on the web, whew that will be tough ),
I wanted to ask if anyone else from here has already had this problem,
and what was the resolution or work-around he or she found. Any other
advice would be very appreciated.

Thank you very much,

 

[Sorin Dolha [MCSD .NET]]

The log on was not required for IIS_WPG, because the user under who the external process is started is a standard user, with log on rights.

I have managed to figure out a solution for the problem, however. Here it is:

First, I have separated the web page which needed to launch the external process in another web application (for security purposes). Then, I created a new Application Pool in IIS 6, and configured it to run under the required user as its identity. This was there was no need to start a the "myApp" external process under another user, but instead I added the code of "myApp" to the web page class' Page_Load method (luckily that I had the source code and it was a C# application also). The web page then automatically redirects back to the other application so that the user under which ASP .NET is running becomes NETWORK SERVICE again, and the web application continues correctly.

Thank you for all the advice,

--
Sorin Dolha [MCAD, MCSD .NET]
You said you were using the API call CreateProcessWithLogonW

Can you go into the local security policy, and add IIS_WPG group in "log
on locally" group. Because not only you need permission to read and
execute but to log on as well.

See if that solves the problem.

However, I am afraid that even if this works, we will be creating a
security loophole because ASP.net account should not be allowed to log
on locally....

But just to test.

regards,
Abhishek.

Abhishek,

I have managed to configure the IIS_WPG users group to have Full rights
on the folder containing MyApp.exe, and then restarted IIS and my
web site but the behavior didn't change: the application failed to
initialize.

Seeing that, I have added IIS_WPG to local Administrators group just to
make sure that a process running under an identity from IIS_WPG can do
anything (read, or write any file anywhere, start any processes it
wants) on the local test computer. The behavior didn't change: the
application failed to initialize.

I will, however, try to find the cause of this annoying problem, and if
I manage to do that I'll let you know what was it.

--
Sorin Dolha [MCAD, MCSD .NET]

"Abhishek Srivastava" <[email protected]
IIS 6.0 has a concept of worker processes. This is very different from
how IIS 5.0 used to work.

In IIS 6.0 workder processes run under a group called IIS_WPG

So you must edit the security configuration of your server to allow
this
group to be able to run processes and be able to read the directory
where the exe is located.

Let me know if this solves the problem.

would need to start searching on the web, whew that will be tough

Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

Hello,

I have an ASP .NET web site (code written in C#), and in one web
page's class I wrote code to call the platform function
CreateProcessWithLogonW (by interoperating with Windows API) to start an
external process and to run it as another user.

The code works great when the site is hosted on my development computer:
Windows XP SP1 (all updates applied), IIS 5. However, when I deploy the
web site to a test Windows Server 2003 (IIS 6) environment, the external
process does not work: the process starts (I can see it running as the
required user in the Task Manager window), but an error message:
"myapp.exe failed to initialize properly" (error code: c0000142), and
then, the process is stopped. The behavior is not process dependent: if
I would use cmd.exe or another process instead of myapp.exe, the same
would happen: the process starts, but this message appears and then the
process is halted.

Myapp.exe functions when it is called from ASP .NET under Windows XP
(IIS 5). Also, myapp.exe process does not create any window on the
desktop (I know this would cause it not to run properly when started
from ASP .NET's process).

Before digging more about this (I didn't found anything in MSDN, so I
would need to start searching on the web, whew that will be tough ),
I wanted to ask if anyone else from here has already had this problem,
and what was the resolution or work-around he or she found. Any other
advice would be very appreciated.

Thank you very much,

 

[Sorin Dolha [MCSD .NET]]

The log on was not required for IIS_WPG, because the user under who the external process is started is a standard user, with log on rights.

I have managed to figure out a solution for the problem, however. Here it is:

First, I have separated the web page which needed to launch the external process in another web application (for security purposes). Then, I have created a new Application Pool in IIS 6, and configured it to run under the required user as its identity. After that I configured the new one-page Web Application to run under the new Application Pool.

This was there was no need to start a the "myApp" external process under another user, but instead I added the code of "myApp" to the web page class' Page_Load method (luckily that I had the source code and it was a C# application also). The web page then automatically redirects back to the other application so that the user under which ASP .NET is running becomes NETWORK SERVICE again, and the web application continues correctly.

Thank you for all the advice,

--
Sorin Dolha [MCAD, MCSD .NET]
You said you were using the API call CreateProcessWithLogonW

Can you go into the local security policy, and add IIS_WPG group in "log
on locally" group. Because not only you need permission to read and
execute but to log on as well.

See if that solves the problem.

However, I am afraid that even if this works, we will be creating a
security loophole because ASP.net account should not be allowed to log
on locally....

But just to test.

regards,
Abhishek.

Abhishek,

I have managed to configure the IIS_WPG users group to have Full rights
on the folder containing MyApp.exe, and then restarted IIS and my
web site but the behavior didn't change: the application failed to
initialize.

Seeing that, I have added IIS_WPG to local Administrators group just to
make sure that a process running under an identity from IIS_WPG can do
anything (read, or write any file anywhere, start any processes it
wants) on the local test computer. The behavior didn't change: the
application failed to initialize.

I will, however, try to find the cause of this annoying problem, and if
I manage to do that I'll let you know what was it.

--
Sorin Dolha [MCAD, MCSD .NET]

"Abhishek Srivastava" <[email protected]
IIS 6.0 has a concept of worker processes. This is very different from
how IIS 5.0 used to work.

In IIS 6.0 workder processes run under a group called IIS_WPG

So you must edit the security configuration of your server to allow
this
group to be able to run processes and be able to read the directory
where the exe is located.

Let me know if this solves the problem.

would need to start searching on the web, whew that will be tough

Use http://groups.google.com... It always finds right solution to any
technical problem .

Microsoft is giving lot of demos and MSDN free seminars on IIS 6.0 so
try to attend one of those.

regards,
Abhishek.

Hello,

I have an ASP .NET web site (code written in C#), and in one web
page's class I wrote code to call the platform function
CreateProcessWithLogonW (by interoperating with Windows API) to start an
external process and to run it as another user.

The code works great when the site is hosted on my development computer:
Windows XP SP1 (all updates applied), IIS 5. However, when I deploy the
web site to a test Windows Server 2003 (IIS 6) environment, the external
process does not work: the process starts (I can see it running as the
required user in the Task Manager window), but an error message:
"myapp.exe failed to initialize properly" (error code: c0000142), and
then, the process is stopped. The behavior is not process dependent: if
I would use cmd.exe or another process instead of myapp.exe, the same
would happen: the process starts, but this message appears and then the
process is halted.

Myapp.exe functions when it is called from ASP .NET under Windows XP
(IIS 5). Also, myapp.exe process does not create any window on the
desktop (I know this would cause it not to run properly when started
from ASP .NET's process).

Before digging more about this (I didn't found anything in MSDN, so I
would need to start searching on the web, whew that will be tough ),
I wanted to ask if anyone else from here has already had this problem,
and what was the resolution or work-around he or she found. Any other
advice would be very appreciated.

Thank you very much,