Identity of asp_wp.exe

[Przemo Karlikowski]

Hello!

How can I change the identity of asp_wp.exe (Asp.Net 2.0) process on Windows
2000 Server from ASPNET to LocalSystem?
I want to do it to bypass SeTcbPrivelege privelege problem.

Unfortunately, the method of changing asp_wp.exe identity described on
http://msdn2.microsoft.com/en-us/lib...hy(vs.80).aspx does not work.

Thank you in advance.

[Juan T. Llibre]

re:
!Unfortunately, the method of changing asp_wp.exe identity described on
!http://msdn2.microsoft.com/en-us/lib...hy(vs.80).aspx does not work.

Yes, it does work. I've helped many people set up accounts using those instructions.
You can safely ignore the Application Pool instructions, since W2K doesn't use them.

re:

How can I change the identity of asp_wp.exe (Asp.Net 2.0) process on Windows 2000 Server from
ASPNET to LocalSystem?

Are you sure you don't mean the SYSTEM account ?

Besides impersonating the user, per the article :

<system.web>
<processModel enable="true"
userName="Syste m" />
</system.web>

The "System" account doesn't need a password.

Also, that only works in machine.config, not in web.config.

I'd avoid impersonating the ASP.NET process account in machine.config.

You should do it, for a particular application, in web.config :
<identity impersonate="tr ue" userName="accou ntname" password="passw ord" />

See:
http://support.microsoft.com/default.aspx/kb/306158

Additionally, run
aspnet_regiis -ga "MachineName\Ac count"

Additionally, make sure the following ACLs are set :
http://msdn2.microsoft.com/en-us/lib...1e(VS.80).aspx

Also, you don't have to run ASP.NET as the SYSTEM account. In fact, you should *avoid* it.
You can run ASP.NET as *any* account you want to, provided you assign the correct permissions.

If you want to go that way ( and you should ), follow the instructions at :
http://msdn2.microsoft.com/en-us/library/ms998297.aspx

....*and* run the steps detailed above.


Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
=============== =============== =====
"Przemo Karlikowski" <ka************ ****@post.plwro te in message
news:OV******** ******@TK2MSFTN GP03.phx.gbl...

Hello!

How can I change the identity of asp_wp.exe (Asp.Net 2.0) process on Windows 2000 Server from
ASPNET to LocalSystem?
I want to do it to bypass SeTcbPrivelege privelege problem.

Unfortunately, the method of changing asp_wp.exe identity described on
http://msdn2.microsoft.com/en-us/lib...hy(vs.80).aspx does not work.

Thank you in advance.

[Przemo Karlikowski]

I already had it in my machine.config:

<system.web>
<processModel enable="true" userName="Syste m" />
</system.web>

I also ran
aspnet_regiis -ga SYSTEM

But instead of killing aspnet_wp.exe I should have restarted whole IIS and
that was the issue.
Now it works.

I'm writing Asp.Net application that manages Windows accounts, and for
several reasons it needs to run on System account.
At least on Windows 2000.
"Juan T. Llibre" <no***********@ nowhere.comwrot e in message
news:%2******** ********@TK2MSF TNGP02.phx.gbl. ..

re:
!Unfortunately, the method of changing asp_wp.exe identity described on
!http://msdn2.microsoft.com/en-us/lib...hy(vs.80).aspx does not
work.

Yes, it does work. I've helped many people set up accounts using those
instructions.
You can safely ignore the Application Pool instructions, since W2K doesn't
use them.

re:

>How can I change the identity of asp_wp.exe (Asp.Net 2.0) process on
Windows 2000 Server from ASPNET to LocalSystem?

Are you sure you don't mean the SYSTEM account ?

Besides impersonating the user, per the article :

<system.web>
<processModel enable="true"
userName="Syste m" />
</system.web>

The "System" account doesn't need a password.

Also, that only works in machine.config, not in web.config.

I'd avoid impersonating the ASP.NET process account in machine.config.

You should do it, for a particular application, in web.config :
<identity impersonate="tr ue" userName="accou ntname" password="passw ord" />

See:
http://support.microsoft.com/default.aspx/kb/306158

Additionally, run
aspnet_regiis -ga "MachineName\Ac count"

Additionally, make sure the following ACLs are set :
http://msdn2.microsoft.com/en-us/lib...1e(VS.80).aspx

Also, you don't have to run ASP.NET as the SYSTEM account. In fact, you
should *avoid* it.
You can run ASP.NET as *any* account you want to, provided you assign the
correct permissions.

If you want to go that way ( and you should ), follow the instructions at
:
http://msdn2.microsoft.com/en-us/library/ms998297.aspx

...*and* run the steps detailed above.


Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
=============== =============== =====

[Juan T. Llibre]

re:

Now it works.

Good news.

re:
!>I already had it in my machine.config:
!I'm writing Asp.Net application that manages Windows accounts, and for
!several reasons it needs to run on System account.

As long as you understand that, by putting that in machine.config,
*all* the applications which run on that server will run as the System account.


Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
=============== =============== =====
"Przemo Karlikowski" <ka************ ****@post.plwro te in message
news:%2******** ********@TK2MSF TNGP02.phx.gbl. ..

>I already had it in my machine.config:

<system.web>
<processModel enable="true" userName="Syste m" />
</system.web>

I also ran
aspnet_regiis -ga SYSTEM

But instead of killing aspnet_wp.exe I should have restarted whole IIS and that was the issue.
Now it works.

I'm writing Asp.Net application that manages Windows accounts, and for several reasons it needs to
run on System account.
At least on Windows 2000.

"Juan T. Llibre" <no***********@ nowhere.comwrot e in message
news:%2******** ********@TK2MSF TNGP02.phx.gbl. ..

>re:
!Unfortunately , the method of changing asp_wp.exe identity described on
!http://msdn2.microsoft.com/en-us/lib...hy(vs.80).aspx does not work.

Yes, it does work. I've helped many people set up accounts using those instructions.
You can safely ignore the Application Pool instructions, since W2K doesn't use them.

re:

>>How can I change the identity of asp_wp.exe (Asp.Net 2.0) process on Windows 2000 Server from
ASPNET to LocalSystem?

Are you sure you don't mean the SYSTEM account ?

Besides impersonating the user, per the article :

<system.web>
<processModel enable="true"
userName="Syste m" />
</system.web>

The "System" account doesn't need a password.

Also, that only works in machine.config, not in web.config.

I'd avoid impersonating the ASP.NET process account in machine.config.

You should do it, for a particular application, in web.config :
<identity impersonate="tr ue" userName="accou ntname" password="passw ord" />

See:
http://support.microsoft.com/default.aspx/kb/306158

Additionally , run
aspnet_regii s -ga "MachineName\Ac count"

Additionally , make sure the following ACLs are set :
http://msdn2.microsoft.com/en-us/lib...1e(VS.80).aspx

Also, you don't have to run ASP.NET as the SYSTEM account. In fact, you should *avoid* it.

>You can run ASP.NET as *any* account you want to, provided you assign the correct permissions.

If you want to go that way ( and you should ), follow the instructions at :
http://msdn2.microsoft.com/en-us/library/ms998297.aspx

...*and* run the steps detailed above.


Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
============== =============== ======