Conferencing Center
Applications Installation & Administration Manual
Page 33
IP Office 3.2
15-601133 Issue 1 (7 June 2006)
Running ASP.NET on a Domain Controller
Problem:
By default, the worker process for Microsoft
®
ASP.NET (Aspnet_wp.exe) runs under the local machine
account to restrict access to domain resources and provide a more secure environment. This will cause
an error if you try to run or debug an ASP.NET application on a domain controller or a backup domain
controller. On a domain controller, all user accounts are domain accounts and not local machine
accounts, so Aspnet_wp.exe fails because it cannot find a local account named
"localmachinename\ASPNET".
Possible Solution:
Create a "weak" account with the correct permissions:
1. Create a user account on the computer and add this user account to the Users group.
2. Grant this user account the Log On as a batch job right. This process may need to be repeated
for the Domain Controller Security and Domain Security policies.
To grant a user account the Log On as a batch job rights:
Click Start > Settings > Control Panel > Administrative Tools.
Double-click Local Security Policy.
Within the Local Security Policy window and under Security Settings, double-click
Local Policies|User Rights Assignment.
In the list of policies, right-click the Log on as a batch job policy and click Security.
If the new user account does not appear in the Assigned To list, click Add to add the
new user account.
Select the Local Policy Setting check box next to the user account name and click OK.
Restart the server, if necessary.
3. Grant the new user account write access to the
\WINNT\Microsoft.NET\Framework\V1.0.XXXX\Temporary ASP.NET Files\ directory. This will
allow the Aspnet_wp.exe process to write temporary files and classes to this directory. Do the
following to grant write access to the necessary directory:
Navigate to the \WINNT\Microsoft.NET\Framework\V1.0.XXXX\ directory in Microsoft
Windows
®
Explorer and right-click the Temporary ASP.NET Files icon.
Click Properties and then click the Security tab.
Select the user account from the list and select the Allow check box for Write
permissions.
Click OK.
Make sure that the new user account has access to all other files and directories that are
necessary to serve ASP.NET pages.
4. Grant the new user account write access to the \WINNT\TEMP\ directory. If you are running XML
Web services, this will allow the Aspnet_wp.exe process to write temporary files and classes to
this directory. Do the following to grant write access to the necessary directory:
Navigate to the \WINNT\TEMP\ directory in Windows Explorer and right-click the TEMP
icon.
Click Properties and then click the Security tab.
Select the user account from the list and select the Allow check box for Write
permissions.
Click OK.
Make sure that the new user account has access to all other files and directories that are
necessary to serve ASP.NET pages.
