Month: January 2005

Recently at work a someone was playing around with AD, and could not get impersonation working in ASP.NET – even hardcoding the userid/pwd did help, and all the time he got an Access is Denied error. After searching high, low, etc. he did find this issue. Interestingly I have never seen this, because well one, I have been working on Windows 2003 Server for the last few months, and two more importantly, my dev box, has not been a Domain Controller! (Why you would want one is another story).

So, it turns out there is a bug and you may experience the behavior when the user account that you use to run the program does not have the Impersonate a client after authentication user right (the SeImpersonatePrivilege function). When you upgrade Windows 2000 Server Domain Controller to SP4, the user account (IWAM) is not granted SeImpersonatePrivilege, and then programs that use impersonation may not work correctly. When you request an ASP.NET 1.1 page, you may receive the following error message: Server Error in ‘/iwamtest’ Application.

Access is denied.
Description An unhandled exception occurred during the execution of the current Web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details
System.ApplicationException: Access is denied.

Source Error
An unhandled exception was generated during the execution of the current Web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace
[ApplicationException: Access is denied. ]

System.Security.Principal.WindowsIdentity._ResolveIdentity(IntPtr userToken) +0 System.Security.Principal.WindowsIdentity.get_Name() +71 System.Web.Configuration.AuthorizationConfigRule.IsUserAllowed(IPrincipal user, String verb) +100 System.Web.Configuration.AuthorizationConfig.IsUserAllowed(IPrincipal user, String verb) +81 System.Web.Security.UrlAuthorizationModule.OnEnter(Object source, EventArgs eventArgs) +178 System.Web.SyncEventExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute() +60
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +87

Workaround: To work around the problem, manually assign Impersonate a client after authentication to the IWAM account. To do so, follow these steps:

1. Click Start, point to Programs, point to Administrative Tools, and then click Domain Controller Security Policy.
2. Click Security Settings.
3. Click Local Policies, and then click User Rights Assignment.
4. In the right pane, double-click Impersonate a client after authentication.
5. In the Security Policy Setting window, click Define these policy settings.
6. Click Add, and then click Browse.
7. In the Select Users or Groups window, select the IWAM account name, click Add, and then click OK.
8. Click OK, and then click OK again.
9. To enforce an update of computer policy, type the following command: secedit /refreshpolicy machine_policy /enforce
10. At a command prompt, type iisreset.

More Information: http://tinyurl.com/6yfx3

Mary Jo Foley has has uncovered an interesting trend up in Redmond: contradiction when it comes to Windows. It seems that the Longhorn team has seven versions on tap, but the company as a whole is paring back Windows versions, folding Home, Pro and others into one SKU. Microsoft is sending mixed signals as to whether it will field more or fewer Windows releases; but she bets there are more, more, more.

The Windows team likes to pride itself on holding its cards close to the vest. But sometimes, that strategy backfires, as it did this week on the Longhorn front.

Microsoft execs have been making a concerted effort not to talk publicly about Longhorn. But that hasn’t stopped others from doing so. And this week, there were lots of conflicting Longhorn leaks:

• Microsoft has at least seven Longhorn variants on the drawing board, including new small-business and an “uber” Windows variant, according to one Windows-watching site. (There’s no Windows Longhorn Reduced Media Edition on the list, but Microsoft’s still in denial about that one.)
• Microsoft is paring back the number of Windows releases and is folding the Home, Professional, Tablet and Windows Media Center releases into one single Longhorn SKU, according to another reporter.
• Microsoft is readying the next two Windows Media Center releases and doesn’t seem to have plans to fold any of the Media Center functionality into other Longhorn SKUs at all, according to a third site.

So, which of these, if any, is true? The Windows client team won’t say. Officials are clinging to the tired line that “it’s too early to talk yet about packaging plans for Longhorn.” But wouldn’t you like to hear more about good old Windows XP instead?

Our sources say that the truth lies at the intersection of all of these reports. We hear Microsoft is thinking about more Windows releases, not fewer — the same way that the Office team and the Visual Studio teams are thinking about ways to broaden their products’ appeal by rolling out more variants.

The “uber” Longhorn release mentioned above — that allegedly will include all of the features of the includes all of the features from the Home, Premium, Pro, Small Business, and Tablet PC Editions — is Microsoft’s trial balloon, our tipsters say.

Microsoft has made no secret of the fact that it is highly likely to add more of its Tablet PC operating system features to the base Windows platform, going forward. And it’s leaning toward doing the same with Media Center.

In fact, the core Windows team is constantly re-examining which features from these two SKUs (Tablet and Media Center) Microsoft should fold into the base-level platform. If a certain market heats up sooner than Microsoft might have anticipated (say, digital photography), Microsoft will be more likely to incorporate Media Center’s digital-photo-handling functionality into the core Windows platform, the Windows client team has said.

At this point in the cycle, Microsoft should have a pretty good idea of what Longhorn will look like, at least if the company is still expecting to ship the final Longhorn product(s) next year. (Our sources say 2006 is still the due date, most likely Q3.) We’re not optimistic we’ll see a Longhorn beta much before the Professional Developers Conference in October, but maybe we’ll be pleasantly surprised.