Microsoft KB Archive/931199

From BetaArchive Wiki
< Microsoft KB Archive
Revision as of 13:18, 21 July 2020 by X010 (talk | contribs) (Text replacement - "&" to "&")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Knowledge Base


The URLScan tool and some ISAPI filters do not work correctly after you upgrade to Windows Vista and Internet Information Services 7.0

Article ID: 931199

Article Last Modified on 2/22/2007



APPLIES TO

  • Microsoft Internet Information Services 7.0



SYMPTOMS

After you upgrade a Microsoft Windows XP-based computer that is running Microsoft Internet Information Services 5.1 to Windows Vista and Internet Information Services 7.0, the URLScan tool and some ISAPI filters do not work correctly.

Additionally, when you try to visit a Web page that is hosted on the Windows Vista computer, you may receive an error message that resembles the following:

HTTP Error 500.0 - Internal Server Error Description: CallingLoadLibraryEx on ISAPIFilter "C:\windows\system32\inetsrv\urlscan\urlscan.dll"

CAUSE

This issue occurs when the Network Service account does not have the correct permissions for the \Windows\System32\Inetsrv\Urlscan folder in Windows Vista.

By default, the URLScan tool runs under a local system account. When you upgrade to Windows Vista and Internet Information Services 7.0, the URLScan tool is upgraded to an application pool that uses the Network Service account. The Network Service is more restrictive than the local system account.

RESOLUTION

To resolve this issue, you must grant the Network Service account the correct permissions to the \Windows\System32\Inetsrv\Urlscan folder in Windows Vista. To do this, follow these steps:

  1. Right-click Start[GRAPHIC: Start button], and then click Explore.
  2. In Windows Explorer, locate the \Windows\System32\Inetsrv folder.
  3. Right-click Urlscan, and then click Properties
  4. Click the Security tab
  5. Click Edit, and then click Add.
  6. In the Enter the object names to select box, type Network Service, click Check Names to verify the name, and then click OK
  7. Grant the Network Service account the following permissions:
    • Read
    • Read & execute
    • List folder contents
  8. Click OK.


MORE INFORMATION

In earlier versions of IIS, the URLScan ISAPI filter was used as an additional layer of security. The URLScan ISAPI filter filtered out potentially malicious requests before they processed by IIS. In IIS 7.0, the request filtering functionality is implemented in the RequestFilteringModule module. IIS 7.0 is included with Windows Vista.

For more information about how to use Request Filtering, visit the following Microsoft Web site:

Keywords: kbtshoot kbprb kbexpertiseinter KB931199