InteropServices.COMException: Access is denied

[Stephane]

Hi,

I want to create a virtual directory when a user has filled a form on an
ASP.net page. It works well on my dev server, but when I try it on my
production server, it fails. I got this error:

System.Runtime.InteropServices.COMException (0x80070005): Access is denied
at System.DirectoryServices.DirectoryEntry.Bind(Boole an throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_IsCont ainer()
at System.DirectoryServices.ChildEnumerator..ctor(Dir ectoryEntry container)
at System.DirectoryServices.DirectoryEntries.GetEnume rator()

This is my code:

DirectoryEntry root = new DirectoryEntry("IIS://localhost/W3SVC");
int siteId = 1;
IEnumerator list = root.Children.GetEnumerator();
while (list.MoveNext() && !isFound)
{
DirectoryEntry e = (DirectoryEntry)list.Current;
if(e.SchemaClassName == "IIsWebServer")
{
string desc = (string)e.Invoke("Get","ServerComment");
if(desc == LIVESNAP_NAME)
{
siteId = Convert.ToInt32(e.Name);
isFound = true;
}
}
}

I tried setting full control to everyone: It failed.
I tries impersonation with an admin account: it works
I tries impersonation with a power user acount: it works sometimes...

How can have this to work without using an admin account? I think this is
not really secure to use an admin username an password in the web.config
file...

Any idea?

Thanks

Stephane

[Joe Kaplan \(MVP - ADSI\)]

You need to have adequate permissions to change the metabase. That
generally involves having an admin level account. If you aren't comfortable
with that, then you probably shouldn't be providing this functionality.

You could move the IIS code to a COM+ DLL under a different identity if you
wanted to make it so that the web application itself didn't have these
privileges, but you still need to ensure that only authorized callers access
your COM+ DLL.

Joe K.

"Stephane" <Stephane@discussions.microsoft.com> wrote in message
news:FADEF0FD-6C57-4DC2-8F74-743BE6430083@microsoft.com...

> Hi,
>
> I want to create a virtual directory when a user has filled a form on an
> ASP.net page. It works well on my dev server, but when I try it on my
> production server, it fails. I got this error:
>
> System.Runtime.InteropServices.COMException (0x80070005): Access is denied
> at System.DirectoryServices.DirectoryEntry.Bind(Boole an throwIfFail)
> at System.DirectoryServices.DirectoryEntry.Bind()
> at System.DirectoryServices.DirectoryEntry.get_IsCont ainer()
> at System.DirectoryServices.ChildEnumerator..ctor(Dir ectoryEntry
> container)
> at System.DirectoryServices.DirectoryEntries.GetEnume rator()
>
> This is my code:
>
> DirectoryEntry root = new DirectoryEntry("IIS://localhost/W3SVC");
> int siteId = 1;
> IEnumerator list = root.Children.GetEnumerator();
> while (list.MoveNext() && !isFound)
> {
> DirectoryEntry e = (DirectoryEntry)list.Current;
> if(e.SchemaClassName == "IIsWebServer")
> {
> string desc = (string)e.Invoke("Get","ServerComment");
> if(desc == LIVESNAP_NAME)
> {
> siteId = Convert.ToInt32(e.Name);
> isFound = true;
> }
> }
> }
>
> I tried setting full control to everyone: It failed.
> I tries impersonation with an admin account: it works
> I tries impersonation with a power user acount: it works sometimes...
>
> How can have this to work without using an admin account? I think this is
> not really secure to use an admin username an password in the web.config
> file...
>
> Any idea?
>
> Thanks
>
> Stephane
>