Psst! Did you know DevelopmentNow is a mobile web site design agency?

Contact us for help mobilizing your site, or to sign up for our beta Mobile Web SDK!
all groups > iis security > november 2005 >

iis security : IIS6 - Virtual Directory to UNC Share error 1326



DaveS
11/30/2005 2:11:03 AM
Trying to map an IIS virtual directory to an area on a separate file server.
The machine running IIS is running stand-alone (no domain). The file server
is in a domain.

The virtual directory is mapped using the Connect As structure using a
domain account and password known to the file server. The area on the file
server has ACLs which allow this domain account to read the area.

When I explore the area in MMC its fine. However, when I browse the site I
David Wang [Msft]
11/30/2005 5:57:57 PM
Behavior in MMC has no relation to browsing the site because the user
identities used to browse are different, depending on IIS configuration.

Read this URL on how to set this up:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/remstorg.mspx

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Trying to map an IIS virtual directory to an area on a separate file server.
The machine running IIS is running stand-alone (no domain). The file server
is in a domain.

The virtual directory is mapped using the Connect As structure using a
domain account and password known to the file server. The area on the file
server has ACLs which allow this domain account to read the area.

When I explore the area in MMC its fine. However, when I browse the site I
either get 401.3 or 500 and 1326 in the event log.

DaveS
11/30/2005 11:27:02 PM
Hi David,

Thanks for the link. However, in my case it does not appear to work. From
Figure 6. the way I'm set up it should be using the UNC metabase
user/password entries (which I've checked using Notepad) via Anonymous
Access. So its either a domain issue (IIS machien is not in it), or some
sort of ACL on the file server which is preventing access, unfortunately I
can;t see the ogs of teh domain server, only the IIS machine.

[quoted text, click to view]
David Wang [Msft]
12/1/2005 4:16:37 PM
Both IIS and the UNC server do not need to be in a domain for remote
fileshare to work -- I use both types all the time. However, there could be
network/IPSec policies that require domain membership -- but that is outside
the scope of IIS and into the realm of networking/access -- you will have to
provide that piece of information

As for ACL -- you can only assume that IIS is walking across the network as
the configured UNC username/password, so verify both UNC Share ACL as well
as NTFS ACL allows that user necessary access.

401.3 indicates that some authenticated user was denied access by ACL -- you
need to determine what user authenticated.

1326 indicates that you authenticated with the wrong username/password.
Probably differences between domain and local user accounts, though you need
to determine what user was being authenticated.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hi David,

Thanks for the link. However, in my case it does not appear to work. From
Figure 6. the way I'm set up it should be using the UNC metabase
user/password entries (which I've checked using Notepad) via Anonymous
Access. So its either a domain issue (IIS machien is not in it), or some
sort of ACL on the file server which is preventing access, unfortunately I
can;t see the ogs of teh domain server, only the IIS machine.

[quoted text, click to view]

AddThis Social Bookmark Button