Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 1881

"IIS APPPOOL\ASP.NET v4.0 Classic" account not able to access HKLM\...\CurrentVersion\Perflib registry key on some Windows 2008 R2 systems

$
0
0

I was looking for something using Process Monitor and came across these:

9:18:50.7032220 AM0.0000217w3wp.exeRegOpenKeyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerflibACCESS DENIEDDesired Access: Read/Writec:\windows\system32\inetsrv\w3wp.exe -ap "ASP.NET v4.0 Classic" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iisipmfe2ae280-15c9-4c86-a961-4f6243eb44e0 -h "C:\inetpub\temp\apppools\ASP.NET v4.0 Classic\ASP.NET v4.0 Classic.config" -w "" -m 1

9:18:50.7032740 AM0.0000099w3wp.exeRegOpenKeyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerflibACCESS DENIEDDesired Access: Readc:\windows\system32\inetsrv\w3wp.exe -ap "ASP.NET v4.0 Classic" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iisipmfe2ae280-15c9-4c86-a961-4f6243eb44e0 -h "C:\inetpub\temp\apppools\ASP.NET v4.0 Classic\ASP.NET v4.0 Classic.config" -w "" -m 1

From the good server:

5:30:57.1296327 AM0.0000075w3wp.exeRegOpenKeyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PerflibSUCCESSDesired Access: Readc:\windows\system32\inetsrv\w3wp.exe -ap "ASP.NET v4.0 Classic" -v "v4.0" -l "webengine4.dll" -a \\.\pipe\iisipm3b4fae66-504e-4a35-80da-1938d7d3125f -h "C:\inetpub\temp\apppools\ASP.NET v4.0 Classic\ASP.NET v4.0 Classic.config" -w "" -m 1

The user account is "IIS APPPOOL\ASP.NET v4.0 Classic". The same keys on other servers can be accessed by this account. Trust setting in web.config and other permissions are the same on all the servers.

The registry key Perflib has read permission for Interactive, Network Service, Local Service, Performance Log User & Performance Monitor User accounts. Administrators and System account has full control.

How to find out why the access is denied?

Thanks


Viewing all articles
Browse latest Browse all 1881

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>