Click here to get back home

ASPNET Account autiding alert
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
ASPNET Account autiding alert M. Simioni 07-12-2005
Posted by M. Simioni on July 12, 2005, 6:10 am
Please log in for more thread options
 Hi, i'm always auditing ASPNET's account accesses on my webserver, a
WIN2K_SP4 + IIS5 + SQLServer2K_SP3a machine.

Nearly all the applications work correctly, but i constantly find a
message in the event viewer under the protection log, that says:

---------------------------------------
Apertura oggetto:
        Server oggetto:        Security
        Tipo oggetto:                File
        Nome oggetto:                C:\WINNT\KOSW047BFJNQUY26
        Nuovo ID dell'handle:        -
        ID dell'operazione:                
        ID del processo:                2160
        Nome utente primario:        ASPNET
        Dominio primario:                WEBSERVER
        ID di accesso primario:        (0x0,0x3F5DE)
        Nome utente client:                -
        Dominio client:                -
        ID di accesso client:        -
        Accessi                        SYNCHRONIZE
                        ReadData (o ListDirectory)

        Privilegi                        -
---------------------------------------

(I'm sorry for the Italian text, but i think you can easily understand
the message)

ASPNET is part of the Users group, and the Users group has the READ,
EXECUTION and LIST permissions on C:\WINNT directory.

What this could be?

I followed all the MS KB to grant the rights priviledges to the ASPNET
account, and no application have a problem at the moment.

Only one application seems to go crazy when the number of users grows
up (we are waiting for another 1GB ram, because we think it's a
resource related issue), but we think it's an application issue not
related to this problem. Or at least, i don't think this warning in the
event viewer is related to that problem.

Thnx i.a. for the answers,
Marco



Posted by Roger Abell on July 12, 2005, 8:48 am
Please log in for more thread options
 Marco,

C:\WINNT\KOSW047BFJNQUY26 appears to be some temporary
directory ?? Is it being created with explicit permissions that will
exclude Users or other grant that includes Dir List for AspNet ?

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
> Hi, i'm always auditing ASPNET's account accesses on my webserver, a
> WIN2K_SP4 + IIS5 + SQLServer2K_SP3a machine.
>
> Nearly all the applications work correctly, but i constantly find a
> message in the event viewer under the protection log, that says:
>
> ---------------------------------------
> Apertura oggetto:
> Server oggetto: Security
> Tipo oggetto: File
> Nome oggetto: C:\WINNT\KOSW047BFJNQUY26
> Nuovo ID dell'handle: -
> ID dell'operazione:
> ID del processo: 2160
> Nome utente primario: ASPNET
> Dominio primario: WEBSERVER
> ID di accesso primario: (0x0,0x3F5DE)
> Nome utente client: -
> Dominio client: -
> ID di accesso client: -
> Accessi SYNCHRONIZE
> ReadData (o ListDirectory)
>
> Privilegi -
> ---------------------------------------
>
> (I'm sorry for the Italian text, but i think you can easily understand
> the message)
>
> ASPNET is part of the Users group, and the Users group has the READ,
> EXECUTION and LIST permissions on C:\WINNT directory.
>
> What this could be?
>
> I followed all the MS KB to grant the rights priviledges to the ASPNET
> account, and no application have a problem at the moment.
>
> Only one application seems to go crazy when the number of users grows
> up (we are waiting for another 1GB ram, because we think it's a
> resource related issue), but we think it's an application issue not
> related to this problem. Or at least, i don't think this warning in the
> event viewer is related to that problem.
>
> Thnx i.a. for the answers,
> Marco
>




Posted by M. Simioni on July 12, 2005, 8:37 pm
Please log in for more thread options
i forgot to say, the name KOSW047BFJNQUY26 changes every time.

i still don't know who try to create that directory/file and when.
i didn't write the applications by myself, i only know that thy use Crystal
Reports, they're written in .NET 2002 and they use a component to draw
charts, dunno if it is that particular component that tryes to write the
directory/file. at least, the programmer said me that he doesn't explicitly
create it.

how can i see if it is being created with explicit permission or other grant
? i can't even find that directory.

thank you,
Marco



> Marco,
>
> C:\WINNT\KOSW047BFJNQUY26 appears to be some temporary
> directory ?? Is it being created with explicit permissions that will
> exclude Users or other grant that includes Dir List for AspNet ?
>



Posted by Sean M on July 12, 2005, 2:55 pm
Please log in for more thread options
This sounds a lot like an attempt to get at the Temporary ASP.NET Pages
cache directory. Are you running the ASP.NET worker process as a different
account that perhaps doesn't have access to the proper directories?

-- Sean M, who admittedly is not fond of changing the identity of the worker
process

> i forgot to say, the name KOSW047BFJNQUY26 changes every time.
>
> i still don't know who try to create that directory/file and when.
> i didn't write the applications by myself, i only know that thy use
Crystal
> Reports, they're written in .NET 2002 and they use a component to draw
> charts, dunno if it is that particular component that tryes to write the
> directory/file. at least, the programmer said me that he doesn't
explicitly
> create it.
>
> how can i see if it is being created with explicit permission or other
grant
> ? i can't even find that directory.
>
> thank you,
> Marco
>
>
>
> > Marco,
> >
> > C:\WINNT\KOSW047BFJNQUY26 appears to be some temporary
> > directory ?? Is it being created with explicit permissions that will
> > exclude Users or other grant that includes Dir List for AspNet ?
> >
>




Posted by M. Simioni on July 12, 2005, 11:50 pm
Please log in for more thread options
The ASPNET account has R/W access to
"C:\WINNT\Microsoft.NET\Framework\v1.0.3705\Temporary ASP.NET Files" and
"C:\WINNT\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files" ( no
FULL CONTROL, only Modify+Read+Write, it's ok? ).

The aspnet_wp process is running under the ASPNET account.

The aspnet_wp process i using 195MB of memory, with a peak of 312MB.
With a process viewer i can see it has abount 22 threads (nearly all of them
regarding mscorsvr.dll).

Marco.

> This sounds a lot like an attempt to get at the Temporary ASP.NET Pages
> cache directory. Are you running the ASP.NET worker process as a different
> account that perhaps doesn't have access to the proper directories?
>
> -- Sean M, who admittedly is not fond of changing the identity of the
> worker
> process
>
>> i forgot to say, the name KOSW047BFJNQUY26 changes every time.
>>
>> i still don't know who try to create that directory/file and when.
>> i didn't write the applications by myself, i only know that thy use
> Crystal
>> Reports, they're written in .NET 2002 and they use a component to draw
>> charts, dunno if it is that particular component that tryes to write the
>> directory/file. at least, the programmer said me that he doesn't
> explicitly
>> create it.
>>
>> how can i see if it is being created with explicit permission or other
> grant
>> ? i can't even find that directory.
>>
>> thank you,
>> Marco
>>
>>
>>
>> > Marco,
>> >
>> > C:\WINNT\KOSW047BFJNQUY26 appears to be some temporary
>> > directory ?? Is it being created with explicit permissions that will
>> > exclude Users or other grant that includes Dir List for AspNet ?
>> >
>>
>
>




Similar ThreadsPosted
UNC mapping alert March 9, 2008, 5:18 am
User Rights for IUSR_xxxx and ASPNET? December 26, 2006, 1:05 am
how to use the user account and the computers account to ... March 9, 2007, 10:38 am
User Account Created - 624 And User Account Enabled - 626 for Hel October 13, 2005, 1:56 pm
Account Policies - NT January 19, 2006, 3:14 pm
Account Being Locked Somewhere August 18, 2006, 6:50 am
Administrator account July 6, 2007, 12:43 pm
OS account report March 17, 2008, 12:42 am
NT4 user account recovery June 3, 2005, 6:29 am
services running under a certain account August 15, 2005, 9:19 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap