Microsoft KB Archive/931199

= The URLScan tool and some ISAPI filters do not work correctly after you upgrade to Windows Vista and Internet Information Services 7.0 =

Article ID: 931199

Article Last Modified on 2/22/2007

-

APPLIES TO


 * Microsoft Internet Information Services 7.0

-



SYMPTOMS
After you upgrade a Microsoft Windows XP-based computer that is running Microsoft Internet Information Services 5.1 to Windows Vista and Internet Information Services 7.0, the URLScan tool and some ISAPI filters do not work correctly.

Additionally, when you try to visit a Web page that is hosted on the Windows Vista computer, you may receive an error message that resembles the following:

HTTP Error 500.0 - Internal Server Error Description: CallingLoadLibraryEx on ISAPIFilter &quot;C:\windows\system32\inetsrv\urlscan\urlscan.dll&quot;



CAUSE
This issue occurs when the Network Service account does not have the correct permissions for the \Windows\System32\Inetsrv\Urlscan folder in Windows Vista.

By default, the URLScan tool runs under a local system account. When you upgrade to Windows Vista and Internet Information Services 7.0, the URLScan tool is upgraded to an application pool that uses the Network Service account. The Network Service is more restrictive than the local system account.



RESOLUTION
To resolve this issue, you must grant the Network Service account the correct permissions to the \Windows\System32\Inetsrv\Urlscan folder in Windows Vista. To do this, follow these steps:
 * 1) Right-click Startvistastartbutton.jpg], and then click Explore.
 * 2) In Windows Explorer, locate the \Windows\System32\Inetsrv folder.
 * 3) Right-click Urlscan, and then click Properties
 * 4) Click the Security tab
 * 5) Click Edit, and then click Add.
 * 6) In the Enter the object names to select box, type Network Service, click Check Names to verify the name, and then click OK
 * 7) Grant the Network Service account the following permissions:
 * 8) * Read
 * 9) * Read & execute
 * 10) * List folder contents
 * 11) Click OK.



MORE INFORMATION
In earlier versions of IIS, the URLScan ISAPI filter was used as an additional layer of security. The URLScan ISAPI filter filtered out potentially malicious requests before they processed by IIS. In IIS 7.0, the request filtering functionality is implemented in the RequestFilteringModule module. IIS 7.0 is included with Windows Vista.

For more information about how to use Request Filtering, visit the following Microsoft Web site:

http://www.iis.net/default.aspx?tabid=2&subtabid=25&i=1040

Keywords: kbtshoot kbprb kbexpertiseinter KB931199

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.