WAS encountered an error attempting to look up the built in IIS_IUSRS group Rule

  • ID:  Microsoft.Windows.InternetInformationServices.2008.WAS.encountered.an.error.attempting.to.look.up.the.built.in.IIS_IUSRS.group
  • Description:   
  • Target:  IIS 7 Web Server
  • Enabled:  On Essential Monitoring

Overridable Parameters

Parameter Name Default Value Description Override
Priority 1  
Severity 1  

Run As Profiles

Name
Default

Rule Knowledgebase

Summary

The Internet Information Services (IIS) Windows Process Activation Service (WAS) is needed for most Web sites because it supports the World Wide Web Publishing Service (W3SVC), which handles HTTP requests. The WAS Process Manager maps application pools to existing worker processes and spawns new instances of W3SVC to host new application pools as needed. If WAS is not available, most Web sites will not start..

Causes
This rule does not contain any causes.
Resolutions

Remap the built-in IIS accounts

IIS 7 uses several built-in Windows Server 2008 accounts, including the IIS_IUSRS group and the IUSR guest user account. These replace the <MACHINE_NAME>_USR account that was created by IIS 6.0.

A problem occurs when a Windows Server 2008 computer that hosts IIS 7 becomes a domain controller (DC) of a non-Windows Server 2008 domain (that is, a DC of a Windows 2000 or Windows Server 2003 domain). When the DC promotion occurs, the new Windows Server 2008 built-in accounts are no longer available to IIS 7. Any Access Control List (ACL) that uses the built-in accounts will not be able to resolve to a friendly name, but will instead show their raw SID (Security Identifier) values.

To resolve this issue, run a script that will restore the mapping of SIDs to friendly names for the built-in accounts. The script must be run on the DC while it is connected to its Primary Domain Controller (PDC). This will reestablish access to the built-in accounts that IIS 7 requires. To obtain the script, see the Knowledge Base article 946139, IIS7 built-in accounts become unavailable after Domain Controller promotion.

External References
This rule does not contain any external references.

See Also for Windows Internet Information Services Management Pack


Downloads for Windows Internet Information Services Management Pack

AZURE OPTIMIZATION ASSESSMENT GET STARTED
MIGRATION TO AZURE GET STARTED
SYSTEM CENTER MIGRATION TO AZURE GET STARTED
MIGRATION TO AZURE FOR SQL AND WINDOWS 2008 GET STARTED