aspnet worker process to start .bat file

[Matt Calhoon]

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the app
needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
..bat file? Does the user need access to the WINNT\System32 directory or the
WINNT\System32\cmd.exe file?

any help appreciated.

[Raghavendra T V]

Hi Matt,

Have a look at this thread.

http://www.experts-exchange.com/Prog..._21038777.html

Hope this helps you.

Thanks
Raghavendra

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the app needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or the WINNT\System32\cmd.exe file?

any help appreciated.

[Raghavendra T V]

Hi Matt,

also check this one

http://authors.aspalliance.com/das/wsh.aspx

Thanks
Raghavendra

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the app needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or the WINNT\System32\cmd.exe file?

any help appreciated.

[Matt Calhoon]

Hi there,

Thankyou for your response. however, I cannot access the first article as it
is password protected?

"Raghavendra T V" wrote:

Hi Matt,

Have a look at this thread.

http://www.experts-exchange.com/Prog..._21038777.html

Hope this helps you.

Thanks
Raghavendra

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the

app

needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or

the

WINNT\System32\cmd.exe file?

any help appreciated.

[Matt Calhoon]

I couldnt find much info on permissions in that article? I have run
sysinternals ntfilemon on the web server and have seen the following
w3wp.exe C:\windows\System32\cmd.exe ACCESS DENIED for user WEBFARM\IUSR_ALL

Does the IUSR_machinename account need access to this file? I wouldnt think
so as the .net worker process runs under the aspnet user.

"Raghavendra T V" wrote:

Hi Matt,

also check this one

http://authors.aspalliance.com/das/wsh.aspx

Thanks
Raghavendra

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the

app

needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or

the

WINNT\System32\cmd.exe file?

any help appreciated.

[Willy Denoyette [MVP]]

Looks like you are running IIS6 (W2K3) in native IIS6 mode, here the worker
process runs with the NETWORK_SERVICE identity not aspnet.
When anonymous access is enabled for this site/application (see IIS
webadmin) and you have set impersonation=true in your web.config, your
thread will run as the anonymous account specified in IIS. By default this
is IUSR_Machine.

Willy.
"Matt Calhoon" <ma**@community.nospam> wrote in message
news:6A**********************************@microsof t.com...

I couldnt find much info on permissions in that article? I have run
sysinternals ntfilemon on the web server and have seen the following
w3wp.exe C:\windows\System32\cmd.exe ACCESS DENIED for user
WEBFARM\IUSR_ALL

Does the IUSR_machinename account need access to this file? I wouldnt
think
so as the .net worker process runs under the aspnet user.

"Raghavendra T V" wrote:

Hi Matt,

also check this one

http://authors.aspalliance.com/das/wsh.aspx

Thanks
Raghavendra

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

> Hi there,
>
> I have specified a aspnet user account to run all .net sites. This
> account
> needs access to start a .BAT File (in my global.asax on session start
> the

app

> needs to execute this bat file). I have given the aspnet user Read and
> execute but the .bat will still not start.
>
> What specific permissions does this user need for other folders to
> start a
> .bat file? Does the user need access to the WINNT\System32 directory or

the

> WINNT\System32\cmd.exe file?
>
> any help appreciated.

[Matt Calhoon]

Thanks for your reply.
I have specified the aspnet user in the default Application Pool Identity
section in IIS (originally it said Network_service). Each website runs under
this default application pool. I therefore assume that IIS runs under this
aspnet user?

Also I have not specified an identity=true in the web.config so it will be
the default (whatever is in the machine config).

"Willy Denoyette [MVP]" wrote:

Looks like you are running IIS6 (W2K3) in native IIS6 mode, here the worker
process runs with the NETWORK_SERVICE identity not aspnet.
When anonymous access is enabled for this site/application (see IIS
webadmin) and you have set impersonation=true in your web.config, your
thread will run as the anonymous account specified in IIS. By default this
is IUSR_Machine.

Willy.
"Matt Calhoon" <ma**@community.nospam> wrote in message
news:6A**********************************@microsof t.com...

I couldnt find much info on permissions in that article? I have run
sysinternals ntfilemon on the web server and have seen the following
w3wp.exe C:\windows\System32\cmd.exe ACCESS DENIED for user
WEBFARM\IUSR_ALL

Does the IUSR_machinename account need access to this file? I wouldnt
think
so as the .net worker process runs under the aspnet user.

"Raghavendra T V" wrote:

Hi Matt,

also check this one

http://authors.aspalliance.com/das/wsh.aspx

Thanks
Raghavendra

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...
> Hi there,
>
> I have specified a aspnet user account to run all .net sites. This
> account
> needs access to start a .BAT File (in my global.asax on session start
> the
app
> needs to execute this bat file). I have given the aspnet user Read and
> execute but the .bat will still not start.
>
> What specific permissions does this user need for other folders to
> start a
> .bat file? Does the user need access to the WINNT\System32 directory or
the
> WINNT\System32\cmd.exe file?
>
> any help appreciated.

[Nick Malik]

This blog entry may be able to help.
http://weblogs.asp.net/dburke/archiv.../05/47755.aspx

--- Nick

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the app needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or the WINNT\System32\cmd.exe file?

any help appreciated.

[Matt Calhoon]

great link - thanks.

however all my settings are already done correctly as specified in this
article.

any other links?

"Nick Malik" wrote:

This blog entry may be able to help.
http://weblogs.asp.net/dburke/archiv.../05/47755.aspx

--- Nick

"Matt Calhoon" <ma**@community.nospam> wrote in message
news:80**********************************@microsof t.com...

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the

app

needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or

the

WINNT\System32\cmd.exe file?

any help appreciated.

[Matt Calhoon]

I have read some iis documentation :
http://www.microsoft.com/windowsserv...rview/iis.mspx

and it states:

Command-line tools not accessible to Web users
Attackers often take advantage of command-line tools that are executable via
the Web server. In IIS 6.0, the command-line tools can’t be executed by the
Web server.

Maybe it is not possible in IIS 6 to execute a .bat file from asp.net?

"Matt Calhoon" wrote:

Hi there,

I have specified a aspnet user account to run all .net sites. This account
needs access to start a .BAT File (in my global.asax on session start the app
needs to execute this bat file). I have given the aspnet user Read and
execute but the .bat will still not start.

What specific permissions does this user need for other folders to start a
.bat file? Does the user need access to the WINNT\System32 directory or the
WINNT\System32\cmd.exe file?

any help appreciated.