Article 10124: TASKE Web Client Applications Display a Services are Not Running Error when IIS is Installed after Applying Windows XP SP2 or Windows Server 2003 SP1
| Products: | TASKE Contact version 8.5, 8.7 & 8.8 |
|
TASKE Reporter version 8.5 & 8.8 |
|
| TASKE Essential version 1.0 |
|
| Applications: | All web client applications |
| Telephone systems: | All |
PrintSummary
When deploying a TASKE web application Microsoft® Internet Information Services (IIS) must reside on the TASKE web server computer. This article explains how security features introduced with Windows XP Service Pack 2 (SP2) and Windows Server 2003 Service Pack 1 (SP1) will deny access to the default IIS user accounts if IIS is installed after applying the service pack. The TASKE Web Server application uses these accounts to communicate with the client applications, and if access is denied to these accounts, access will also be denied to the TASKE web client applications.
Issue
The following error displays when attempting to access the log in page for a TASKE web application:
<TASKE Web Application Name> Services Are Not Running
In TASKE Console, all required TASKE servers and services are running.
Reason
Microsoft IIS was installed on the TASKE web server computer after applying:
-
Windows XP SP2, or
-
Windows Server 2003 SP1
The security features provided with the service pack are denying access to the default local user accounts (IUSR and IWAM) created by IIS. The TASKE Web Server application uses these accounts to communicate with the client applications.
Note: if IIS is installed before Windows XP SP2 or Windows Server 2003 SP1 is applied, access to the IIS user accounts is granted automatically.
Solution
The permissions to the IIS user accounts must be changed to accept requests from the TASKE Web Server application. Use one of the following two methods from the TASKE web server computer to change the permissions for these accounts.
-
granting all applications access to the IIS IUSR and IWAM accounts
-
granting only the TASKE Web Server access to the IIS IUSR and IWAM accounts
The second method is more secure, but the user accounts may need to be unblocked again if the TASKE web server components are re-installed or upgraded. The first method unblocks the user accounts permanently, but is less secure.
If after following these steps, you still receive a Services Are Not Running error, follow the steps listed in Article 10175: Recreating IIS IUSR_<machine name> and IWAM_<machine name> Accounts.
Further Information
For further information on this issue relating to Windows XP Service Pack 2, refer to Microsoft's Article: Service Pack 2 Functionality Changes
.
For further information on this issue relating to Windows Server 2003 Service Pack 1, refer to the Microsoft Article: Changes to Functionality in Microsoft Windows Server 2003 Service Pack 1.
Granting All Applications Access to the IIS IUSR and IWAM Accounts
Use the following instructions from the TASKE web server computer to grant all applications access to the IIS IUSR and IWAM user accounts.
Select Run from the Windows Start menu and run dcomcnfg.exe to open the Component Services window.
In the Console Root tree, expand Component Services, expand Computers, right-click My Computer, and select Properties. If a Windows Security Alert displays, click Unblock add the Microsoft Management Console to the Firewall Exceptions list.
In the My Computer Properties, select the COM Security tab. Click Edit Default in the Launch and Activation Permissions section to open the Launch Permission dialog box.
Click Add to open the Select Users dialog box and click Locations to open the Locations dialog box. Select the computer name at the top of the location list and return to the Select Users dialog box. In the Enter the object names to select box, enter:
IUSR_<machine name>;IWAM_<machine name>
where <machine name> is the local computer name.
Return to the Launch Permission dialog box and select the IUSR_<machine name> user and enable the Allow check boxes for Local Launch, Remote Launch, Local Activation, and Remote Activation. Select the IWAM_<machine name> user and enable the Allow check boxes for all four permission options.
Close all windows. Select Run from the Windows Start menu and run iisreset.exe to stop and restart IIS.
Granting the TASKE Web Server Access to the IIS IUSR and IWAM Accounts
Use the following instructions from the TASKE web server computer to grant the TASKE Web Server access to the IIS IUSR and IWAM user accounts.
Select Run from the Windows Start menu and run dcomcnfg.exe to open the Component Services window.
In the Console Root tree, expand Component Services, expand Computers, expand My Computer, and expand DCOM Config. If a Windows Security Alert displays, click Unblock add the Microsoft Management Console to the Firewall Exceptions list.
Scroll down the DCOM Config list, right-click ttwebsv and select Properties. In the ttwebsv Properties, select the Security tab, enable the Customize radio button in the Launch and Activation Permissions section, and click the Edit button to open the Launch Permission dialog box.
Click Add to open the Select Users dialog box and click Locations to open the Locations dialog box. Select the computer name at the top of the location list and return to the Select Users dialog box. In the Enter the object names to select box, enter:
IUSR_<machine name>;IWAM_<machine name>
where <machine name> is the local computer name.
Return to the Launch Permission dialog box and select the IUSR_<machine name> user and enable the Allow check boxes for Local Launch, Remote Launch, Local Activation, and Remote Activation. Select the IWAM_<machine name> user and enable the Allow check boxes for all four permission options.
Close all windows. Select Run from the Windows Start menu and run iisreset.exe to stop and restart IIS.