Failed to execute request because the App-Domain could not be crea

I have a Windows Server 2003, SP1 machine on which I'm hosting web
applications (web pages and web services).  These apps have been working fine
for more than a year.

As far as I know, no one in the company made any changes to this machine.
We do NOT have Windows Update enabled, but 10 days ago I did download all the
updates (except for SP2), installed and everything was fine .... until ....
two days ago one of the web apps crashed bad.  We got this:

Failed to execute request because the App-Domain could not be created.
Error: 0x80070005 Access is denied.

After net-searching for the error, I found that I needed to give the IIS_WPG
group read access to the web directories.  I did this, restarted the web apps
and all is good now.

Here's the question: if the web apps were working just fine 3 days ago (and
for a year before that), and no one made any changes to that machine, why
would this problem suddenly arise two days ago?


(Norton Antivirus 10 was installed on that machine 5-10 days ago, could that
have caused a delayed reaction problem?)

It could I guess. This points to a permissions issue more than anything.

It could I guess.  This points to a permissions issue more than anything.
Is there anything in the event log?  If this machine is part of an AD
domain, have there been any Group Policy changes recently that would affect
permissions?    You can run gpresult at the command line to see what
policies are being applied.  FYI..Domain polices will overrule local
policies.  I'd not try to invent the issue, more than likely someone changed
something and didn't communicate or document it.

--

Thank you,

Steve Schofield
Windows Server MVP - IIS
ASPInsider Member - MCP

http://www.orcsweb.com/
Managed Complex Hosting

Thanks a lot Steve.

Thanks a lot Steve.  After running gpresult, it looks likely that we're
getting nightly Group Policy pushes, I'll see if the network guys can help me
out with this.

A few more questions for you, if you don't mind:
1. Now that I have given IIS_WPG permissions to the proper directories, do I
need to worry about the network guys overriding those permissions?  (I
suspect that before this change I had given IUSR_machinename permissions to
the directories, I KNOW I never gave IIS_WPG permissions to those directories
during my initial setup)

2. When I fixed this issue "the first time", I gave IIS_WPG read permissions
to the c:\intepub directory (and its child directories), restarted the web
site and all was good for the rest of that day.  The following day the web
site was broken again (that server is rebooted nightly).  Ooops - my virtual
directory for that app was actually on the D drive - so I gave IIS_WPG read
permissions to the proper directory for that web app (on the D drive this
time), restarted the app (touched the web.config file) and it started working
again.  Question: do you have any idea why, when I applied the initial fix to
the c:\inetpub directory (and its children) which did NOT include the virtual
directory, the app started working again?  (I hadn't applied the fix to all
necessary directories, but the app started working again, only to stop the
next day)

Thanks again!

TRZ

I can't say for sure.

I can't say for sure.  Usually a member server will check with the domain
for group policy refresh every 60 to 120 minutes.  Some say 90 minutes, this
can vary.  They *can* apply policies to override your settings.  I doubt
they would on purpose, but you never know.  If you see something besides
Default Domain Policy listed, it is a good chance a policy is causing the
issue.  I would enable auditing to see if someone else is making changes.
Do you have any other scripts, viruses, or something else that has admin
access to change permissions.  Things like robocopy jobs that would change
permissions.  those are a few ideas.

--

Thank you,

Steve Schofield
Windows Server MVP - IIS
ASPInsider Member - MCP

http://www.orcsweb.com/
Managed Complex Hosting