Hi

I have an intranet page that starts / stops windows services on the local
machine.
This works fine on my dev machine and indeed all machine that I have tried
it in that are NOT domain controllers.

unfortunatly the machine I want this to run on is a dc.
I have turned on windows authentication In IIS.

however the minute I place the line "<identity impersonate="true"/>" in web
config, I get an acess denied error.

I ma assuning that the accout running the website does not have permission
to impersonate a user.

so what I am asking is how to preform impersonation on a DC, or is this
asking for trouble from security standpoint

if i do not put the "<identity impersonate="true"/>" line in web config,
and execute the following code

Response.Write("Windows Account running page - [" &
System.Security.Principal.WindowsIdentity.GetCurrent().Name & "]<br>")

I get the "IWAN_...." account where as I would have thought that I would
have got the asp.net account.

get anybody tell me (or point me to an article telling me) how to get
impersonation to work on a DC.


cheers

martin

[quoted text, click to view]

¤ Hi
¤
¤ I have an intranet page that starts / stops windows services on the local
¤ machine.
¤ This works fine on my dev machine and indeed all machine that I have tried
¤ it in that are NOT domain controllers.
¤
¤ unfortunatly the machine I want this to run on is a dc.
¤ I have turned on windows authentication In IIS.
¤
¤ however the minute I place the line "<identity impersonate="true"/>" in web
¤ config, I get an acess denied error.
¤
¤ I ma assuning that the accout running the website does not have permission
¤ to impersonate a user.
¤
¤ so what I am asking is how to preform impersonation on a DC, or is this
¤ asking for trouble from security standpoint
¤
¤ if i do not put the "<identity impersonate="true"/>" line in web config,
¤ and execute the following code
¤
¤ Response.Write("Windows Account running page - [" &
¤ System.Security.Principal.WindowsIdentity.GetCurrent().Name & "]<br>")
¤
¤ I get the "IWAN_...." account where as I would have thought that I would
¤ have got the asp.net account.
¤
¤ get anybody tell me (or point me to an article telling me) how to get
¤ impersonation to work on a DC.
¤

See if the following helps:

Running ASP.NET on a Domain Controller
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/e2k3/e2k3/_exch2k_running_asp_net_on_a_dc.asp

FIX: ASP.NET does not work with the default ASPNET account on a domain controller
http://support.microsoft.com/default.aspx?scid=kb;en-us;315158

BUG: IWAM Account Is Not Granted the Impersonate Privilege for ASP.NET 1.1 on a Windows 2000 Domain
Controller with SP4
http://support.microsoft.com/default.aspx?scid=kb;en-us;824308


Paul
~~~~