You receive a "Service Unavailable" error message when you browse an IIS 6.0 Web page on a Windows Server 2003-based domain controller (842493)


The information in this article applies to:

  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Web Edition

SYMPTOMS

When you browse a Web page that is hosted on a Microsoft Windows Server 2003-based domain controller, you may receive the following Active Server Pages (ASP) Error 5 error message:
Service Unavailable
Additionally, the following warning event may be logged in the system event log: Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1009
Date: Date
Time: Time
User: N/A
Computer: Computer_Name
Description:
A process serving application pool 'Application_Pool_Name' terminated unexpectedly. The process id was '5288'. The process exit code was '0xffffffff'.

For more information, see Help and Support Center at <http://support.microsoft.com.> Additionally, the following error event may be logged in the application event log: Event Type: Message
Event Source: Active Server Pages
Event Category: None
Event ID: 5
Date: Date
Time: Time
User: N/A
Computer: Computer_Name
Description:
Error: The Template Persistent Cache initialization failed for Application Pool 'Application_Pool_Name' because of the following error: Could not create a Disk Cache Sub-directory for the Application Pool. The data may have additional error codes.

For more information, see Help and Support Center at <http://support.microsoft.com.> When you use Filemon to monitor file activity, you receive an error message that is similar to the following:
3521 Time w3wp.exe:3168 CREATE C:\WINDOWS\system32\inetsrv\ASP Compiled Templates\PID3168.TMP ACCESS DENIED NT AUTHORITY\NETWORK SERVICE

CAUSE

This issue may occur if the server that is running Microsoft Internet Information Services (IIS) 6.0 is also a domain controller. The problem occurs because the Application pool is using the NT Authority\Network Service account, and the NT Authority\Network Service account may not have permissions to access the required folders.

RESOLUTION

To resolve this problem, manually set permissions on the folders for the IIS_WPG group, and then set permissions on the folders for the NT Authority\Network Service account.

To set permissions on the folders for the IIS_WPG group, follow these steps:
  1. Start Windows Explorer, and then open the following folder:

    %systemroot%\Help\iisHelp

  2. In the right pane, right-click the Common folder, and then click Sharing and Security.
  3. Click the Security tab, click Add, type IIS_WPG, and then click OK.
  4. With IIS_WPG selected, click to select the following check boxes under the Allow column, and then click OK:
    • Read and Execute
    • List Folder Contents
    • Read
  5. Open the following folder:

    %systemroot%\system32\inetsrv

  6. In the right pane, right-click the ASP Compiled Templates folder, and then click Sharing and Security.
  7. Click the Security tab, click the IIS_WPG group, and then click to select the Full Control check box under the Allow column. Click OK.
  8. Open the following folder:

    %systemroot%

  9. In the right pane, right-click the IIS Temporary Compressed folder, and then click Sharing and Security.
  10. Click the Security tab, click the IIS_WPG group, and then click to select the Full Control check box under the Allow column. Click OK.
To set permissions on the folders for the NT Authority\Network Service account, follow these steps:
  1. Start Windows Explorer, and then open the following folder:

    %systemroot%\Help\iisHelp

  2. In the right pane, right-click the Common folder, and then click Sharing and Security.
  3. Click the Security tab, click Add, type NETWORK SERVICE, and then click OK.
  4. With NETWORK SERVICE selected, click to select the following check boxes under the Allow column, and then click OK:
    • Read and Execute
    • List Folder Contents
    • Read
  5. Open the following folder:

    %systemroot%\system32\inetsrv

  6. In the right pane, right-click the ASP Compiled Templates folder, and then click Sharing and Security.
  7. Click the Security tab, click Add, type NETWORK SERVICE, and then click OK.
  8. With the NETWORK SERVICE group selected, click to select the Full Control check box under the Allow column, and then click OK.
  9. Open the following folder:

    %systemroot%

  10. In the right pane, right-click the IIS Temporary Compressed folder, and then click Sharing and Security.
  11. Click the Security tab, click Add, type NETWORK SERVICE, and then click OK.
  12. With the NETWORK SERVICE group selected, click to select the Full Control check box under the Allow column, and then click OK.
After you have completed these steps, restart the IIS Admin service from the Services snap-in or from the Computer Management snap-in.

WORKAROUND

You may be able to temporarily work around this problem by restarting the IIS Admin service from the Services snap-in or from the Computer Management snap-in.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

For additional information about a similar issue with a different cause, click the following article number to view the article in the Microsoft Knowledge Base:

332097 DCPROMO does not retain permissions on some IIS folders

Modification Type:MajorLast Reviewed:9/22/2006
Keywords:kberrmsg kbprb KB842493 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.