Sudden problem with Dashboard

[Brewhaus]

Yesterday we had to move our web folder to a different hard drive, as the previous drive was starting to have issues (death is imminent). We had to reinstall our license key (which I thought was odd, seeing as the site was still on the same IP, domain, and server), but that went smoothly. The only apparent issue is that we cannot access the dashboard, and when trying to log into the Admin menu (which automatically takes you to the dashboard) we get an error screen.

Before you ask what the error is, we have custom errors turned on. When we turn custom errors off, then the error disappears and we can access the dashboard. When turning custom errors back on we can access the dashboard for a short time, but then begin getting the error again.

Does anyone have any ideas? I was hoping to find exactly what the error was, but seeing as everything works when custom errors are off, there is no hope for that. We intend to replace the faulty drive and move the files back, but want to see if we can resolve this issue first.

[mazhar]

Did you checked the Application log. If not have a look at that after turning on the custom errors and reproducing the problem.

[Brewhaus]

The event ID created is as follows:

Event code: 4011
Event message: An unhandled access exception has occurred.
Event time: 2/12/2009 1:28:40 PM
Event time (UTC): 2/12/2009 7:28:40 PM
Event ID: b2fcc7095ba84f9f94dca3b176fa100d
Event sequence: 634
Event occurrence: 3
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1139245285/Root-4-128789241757031250
Trust level: Full
Application Virtual Path: /
Application Path: C:\New Folder\Websites\Hot Sauce Depot\
Machine name: SERVER

Process information:
Process ID: 6020
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Request information:
Request URL: https://www.hotsaucedepot.com:443/Admin/Default.aspx
Request path: /Admin/Default.aspx
User host address: 68.71.76.44
User: rick.morris@brewhaus.com
Is authenticated: True
Authentication Type: Forms
Thread account name: NT AUTHORITY\NETWORK SERVICE

Custom event details:

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[Logan Rhodehamel]

A) Is there a folder in the website called "webcharts"?
B) Does the network service user have read/write permissions to that folder?

[Brewhaus]

I compared the permissions with the folder on the old drive, and there are some differences in the 'User' permissions. The Network Service appears to have the same settings for the folder as on the previous drive.

One thing that was never well laid out in AC's setup instructions was permissions. Since I will have to reset the permissions for the folders, does anyone have this laid out so that we can go through our settings and be sure to have them optimized?

[Logan Rhodehamel]

The reason I asked specifically about webcharts - this is a folder where writes typically occur from the admin dashboard. Your error is a user access error. It stands to reason that the cause of your symptom revolves around some failed write attempt to webcharts. If you have access to the server, make sure this folder exists and give "everyone" read/write access temporarily. Access the dashboard and see if that resolves the issue. This way, you will know if permissions to this folder are the problem or if it's something else.

In the 7.0.2 release we updated our installation script to specifically check for all required permissions. That way we can alert the installing user if something is out of place.

These folders need read/write access for the ASPNET user (usually Network Service): App_Data, App_Themes, Assets, webcharts.

[Brewhaus]

I did as you suggested earlier (gave 'User' read, write, modify on webcharts) and the problem was resolved. I took those permissions back off, as I figured that worst case I could go folder by folder and replicate the permissions that I had previously, although I believe that the entire list of folders had similar permissions, which is likely not a good idea.

Aside from giving Network Service read/write permissions for the folders that you mentioned, should all other folders have a standard set of permissions for Users? If so, what do you suggest those permissions should be in order to avoid giving too much permission, but not create issues with site operation?

[Logan Rhodehamel]

For the remainder of the website, I believe it is sufficient for Network Service and the anonymous internet user to have read access.

[AbleMods]

Microsoft has a good tool for locking down a web server if you have access to the server console. Look for the IIS Lockdown tool. Besides helping with folder permissions, it also looks for open ports, unnecessary services etc.

Not a single solution but a good tool in a broader collection of server security techniques.

[hbcondo]

I'm was having the same problem too and loosening the permissions on the webcharts folder did the trick. There's a permissions test file on the help website but it does not test the webcharts directory.