Access Denied when Writing Files to a windows 2008 R2 server over the network

When Trying to edit/change a file to an IIS Share on one of the windows 2008 R2 servers you get an error message that access has been denied.
The user writing the files has all the proper security settings on both the share and the directory/file.
The user can create new files in the directory.

If the user logs in to the server and tries to change the file he gets a message stating: You'll need to provide administrator permission to copy/move/edit etc... this file



This problem can be resolved by giving the users group write permissions to the folder.

Using Microsoft Office 2007 with DCOM on a webserver in a safe way

It's been a while since I've written anything on the blog, but I think that I have something interesting for some people now.

These past weeks I have been battling our webservers and application to get DCOM calls from IIS to Microsoft Office 2007 working. After several high hopes and nervous breakdowns I have found solutions to all the catches I have found.

I'll first describe our environment a bit.
We have Windows server 2008 R2 servers (that means it's running x64mode) with Office 2007 (that's 32 bit) installed on it. The Webserver needs to be able to make a snapshot of a certain page in an uploaded Office document and show it on the website.

To be able to open Office from IIS you need to change DCOM security for the Office applications.

So the first problem that can happen is that after installing Office you don't find the objects in the Component Services MMC, normally they should be under "Component Services"/"Computers"/"My Computer"/"DCOM Config".
If you can't find them, open the Component Services MMC in 32 bit mode by opening a run box (-R) and typing "mmc -32" (without the quotes). Then add the Component Services Snap-in using "File"/"Add/Remove Snap-in" then select "Component Services" and click on "Add".
Now the office applications should be visible under "Component Services"/"Computers"/"My Computer"/"DCOM Config".
(this solution is described on many blogs over the Internet, I just repeat it here to have a more complete solution in one place)

The next problem is that IIS 7.5 by default runs under the Account "IIS AppPool\DefaultAppPool", people often change this to "network Service" or even "local System" (YUCK!!!! Really people.... Never run IIS under "local system"!!! this means that if a hacker can exploit IIS he will be GOD on your system)
This is a security feature from Microsoft that I don't want to turn off lightly... So I don't!!!

I just give the user "IIS AppPool\DefaultAppPool" the rights on the locations it needs.. (including DCOM activation)
However this user cannot run Office by himself, so we will have to create a proxy user which I'll call sa_DCOM for now (sa meaning Service Account) This user needs to be in the users group and have write rights to the location where office will need to write the files)

So open the Component services MMC.
A lot of sites tell you to change the default security on "Component Services"/"Computers"/"My Computer"/"DCOM Config" itself. But this is not best practice as that way you'll open up all the DCOM applications on your server to be exploited by hackers.
so navigate to the path "Component Services"/"Computers"/"My Computer"/"DCOM Config" and then open up the properties to "Microsoft (Office) Word 97 - 2003 Document" (the Office depends on the version of office you have. In 2010 it's no longer there)
now do the following settings:

Security/ Launch and Activation Permissions Customize -> Selected,
Edit
Add: IIS AppPool\DefaultAppPool with local launch and activation rights

Security/ Access Permissions Customize -> Selected
Edit
Add: IIS AppPool\DefaultAppPool with local Access rights

Security/ Configuration Permissions Customize -> Selected
Edit
Add: IIS AppPool\DefaultAppPool with read rights

Identity -> This user-> Selected, User = \sa_DCOM.

This way Office and IIS will allways run with the lowest permission needed.

Now we would think that we're there...
Alas not!

Microsoft Office Word needs the user that runs the application to have it's registry keys loaded.
The problem is that, as soon as the user sa_DCOM is logged off, its hive unloaded. So we'll have to find a way to keep the profile loaded. My solution for this is that I have created a dummy service which does absolutely nothing and let that service run as sa_DCOM. As soon as the service starts the profile is loaded and Word will run without problems. (so set the service to start automatically).

The settings for Word that I have done above can be done for Powerpoint and Excel also. And other programs also I would think, however I have only tested these three...

I hope that some of you guys will be spared (any more) hear tearing and crying by reading this post.

Here are some of the DCOM Errors I have solved with the above solution:
Error Exception from HRESULT: 0x800A03EC
Exception from HRESULT: 0x800AC472
and of course the access denied error 0x80004005

Renaming Domain group Display names in WSS 2.0

Recently I saw a post on the Net about the impossibility to rename the Display name of a domain group in WSS 2.0

This is a "Well, Actually" post as I replied in that thread.

The Solution is Ugly and should only be executed if you're deperate.
As allways: Test in a non-production environment first!!!

If you execute the following Sql Statement on your Content Database

you can find the GUID of the user/group

SELECT tp_SiteID, tp_Login, tp_Title, tp_GUID
FROM UserInfowhere Tp_Title = ''

You'll then find an entry to a site 'user' for every site it is a member of.
Normally all users would have the Same tp_GUID.

If not, then there have been two different domain groups with that same name.
For example a group was created and added to SharePoint,
then later the group was deleted in the domain,
and even later recreated and readded to SharePoint,

To get the GUID of the proper 'user',
add the group to the security of one of the site's lists
and now the tp_Login in the database will have changed to the new groupname.

You can now write an SQL update script to change the tp_login and tp_title to the new value

UPDATE [UserInfo]
SET tp_Login = '', tp_Title = ''
WHERE tp_GUID = 'GUID of the DomainGroup'

DISCLAIMER....
As I said, this is a rather ugly solution, only to be tried by the desperate, and only after extensive testing in a test environment.I myself have never been desperate enough to do this.
Of course such database hacking will never be supported by Microsoft, or by me ;o)
this solution is for WSS 2.0 but with some logical thinking could probably be used for WSS 3.0 (and SPS 2003 and MOSS 2007) also

Windows 7

It's been a while since I last wrote here, but now I have some new things I noticed and would like to share.

At the moment I am testing the Beta of Windows 7 and it's great so far... At least if you remember that it's a beta. It's stable, fast and very goodlooking.

I really like the new taskbar. It takes a few days to get used to, but then it's really practical.

maybe people would complain that it's not clear which programs are active, but I think it's clear...

A program that has been started is style a little more like a button.

In the picture to the left, the left and right program (Visio and Notepad) haven't been started yet, but the middle one (Project) has...

You can also see if a program has been started multiple times by the way the program is presented. There will be a double line to the right of the icon, like in the picture to the right. Here you'll see that Internet Explorer has been opened multiple times.

Another neat addition to W7 is, that there is now a builtin screenshot tool called the "Snipping tool"

Just a few of the many changes in Windows 7.

I also noticed a little problem. At our office we use several static routes as a temporary measure for reaching certain network locations. When I installed W7 I felt bold and did an upgrade, amazingly it went without problems... well almost... after the reinstallation the static routes were still there, but they didn't work anymore.

The resolution was simple, delete the routes and recreate them...

Office Customization tool not visible in Microsoft Deployment Toolkit

When you don't see the button "Office Customization Tool" in the "Office Products" tab for an office application in the Deployment Workbench, then it could be that you don't have the admin folder in the source directory of your application.
My installation source for Office Ultimate didn't have the button. When I continued adding applications I noticed that my Sharepoint Designer 2007 did have this button, I compared the installation directories and noticed the missing admin folder. I noticed that in this admin folder where not only files for the sharepoint designer but also for the other 2007 products. When I copied this directory to the other directories i saw the "Office Customization Tool" button. No need to recreate the package.

Setting the height of a Div in Javascript works in Internet Explorer but not in Firefox

If you notice this in you program, you're probably giving the height as an integer instead of in units.
For example:


function SetHeights() {
divMain = getElementsById("Main");
divWrapper = getElementsById("Wrapper");
divHeaderWrap = getElementsById("HeaderWrap");
divFooter = getElementsById("Footer");
divMain.style.height = Math.max(divWrapper.offsetHeight - (divFooter.offsetHeight + divHeaderWrap.offsetHeight + 18), 0);
}

You should set the height in pixels or em etc.:


function SetHeights() {
divMain = getElementsById("Main");
divWrapper = getElementsById("Wrapper");
divHeaderWrap = getElementsById("HeaderWrap");
divFooter = getElementsById("Footer");
divMain.style.height = Math.max(divWrapper.offsetHeight - (divFooter.offsetHeight + divHeaderWrap.offsetHeight + 18), 0)+"px";
}

Network teaming in Windows 2008 Server

To create a teaming in windows 2008 server just go to "Start", "Network", then "Network and Sharing Center" and then "manage network connections".
After that select the two network cards you wish to team and select "Bridge Connections"

Warnings with CSS classes and Masterpages in Visual Studio 2008

When you create a new masterpage in Visual studio 2008 that contains a link to a stylesheet it can happen that the IDE thinks that the classes defined in the stylesheet cannot be found even though the compiled website will use the classes defined in the stylesheet.

use the following code to replicate the issue.

{/MasterPage.master}


<%@ Master Language="C#" AutoEventWireup="true" CodeFile="MasterPage.master.cs" Inherits="testpages_master_with_css_problem_MasterPage" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Untitled Page</title>
<asp:Literal ID="Literal1" Visible="false" runat="server">
<link href="~/Styles/StyleSheet.css" rel="stylesheet" type="text/css" />
</asp:Literal>
<asp:ContentPlaceHolder ID="head" runat="server">
</asp:ContentPlaceHolder>
</head>
<body>
<form id="form1" runat="server">
<div id="someId1" class="someClass1">
<asp:ContentPlaceHolder ID="ContentPlaceHolder1" runat="server">
</asp:ContentPlaceHolder>
</div>
</form>
</body>
</html>



{/default.aspx}

<%@ Page Language="C#" MasterPageFile="~/MasterPage.master" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="testpages_master_with_css_problem_Default" Title="Untitled Page" %>

<asp:content id="Content2" contentplaceholderid="ContentPlaceHolder1" runat="Server">
<div id="someId2" class="someClass2">
<asp:label id="myLabel" cssclass="someClass3" runat="Server">This is text with styles from all classes and id's</asp:Label>
</div>
</asp:Content>


{/Styles/StyleSheet.css}

body
{
font-family: Arial;
font-size: medium;
font-weight: normal;
font-style: normal;
font-variant: normal;
text-transform: none;
color: #000000;
}
.someClass1
{
font-family:Times New Roman;
}
.someClass2
{
font-size:xx-large;
}
.someClass3
{
color:Red;
}
#someId1
{
font-style:italic;
}
#someId2
{
text-transform:capitalize;
}


If you open these pages in you Visual Studio 2008 IDE and wait a while in a page you will get warnings:

• Warning 1 The class or CssClass value is not defined. C:\...\MasterPage.master 14 30 C:\...\Stylesheet classes problemsdemo\


• Warning 2 The class or CssClass value is not defined. C:\...\Default.aspx 7 26 C:\...\Stylesheet classes problemsdemo\


• Warning 3 The class or CssClass value is not defined. C:\...\Default.aspx 8 39 C:\...\Stylesheet classes problemsdemo\

However, if you open the page in a browser, all styles will be applied.

It seems that for ID's no warning for non-existant identifiers is given (I also checked using non existant ID's), but for classes the warning is generated.

There is some more odd behaviour at hand here. At the moment I give "someId2" a non-existant identifier ("someId2fdsaf") the warning for "someClass3" disappears.

The warnings also seem to depend on the CcontentPlaceHolder in the header, as soon as I remove that placeholder from "Default.aspx" all warnings in that file disappear...

However in the "MasterPage.master" this behaviour can not allways be reproduced. (I have seen this for the masterpage in my original project, but in this demoproject it doesn't solve the warning.)

If you remove the '~' from the link to the stylesheet then the warnings disappear but then you'd have a problem deploying your site to a place below the root of the site. This would however seem to indicate that the IDE has a problem solving this relative link.

This is not something critical, but when you use cssClasses a lot in your code you'd probably want to be warned if you made a mistake. (so unchecking CSS warnings on the project is not a solution to this problem)

I'm still researching this problem and will come back if I find a solution.

If anybody can provide help, it would be very welcome.

What I found on the Internet is that for '~' to work it needs to be run with runat="server". Lancerfisher wrote a nice piece about it. When I added his solution I was able to reproduce what I said above, that removing the ContentHolder from the head resolves the warnings.

If you edit your masterpage to resemble the following the warnings are gone


<%@ Master Language="C#" AutoEventWireup="true" CodeFile="MasterPage.master.cs" Inherits="testpages_master_with_css_problem_MasterPage" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Untitled Page</title>
<asp:Literal ID="Literal1" Visible="false" runat="server">
<link href="~/Styles/StyleSheet.css" rel="stylesheet" type="text/css" />
</asp:Literal>
</head>
<body>
<form id="form1" runat="server">
<div id="someId1" class="someClass1">
<asp:ContentPlaceHolder ID="ContentPlaceHolder1" runat="server">
</asp:ContentPlaceHolder>
</div>
</form>
</body>
</html>

but again this is not the solution.

Ok, problem is solved...

It seems that Microsoft figured that this was a bug too. :o) I installed Visual Studio 2008 SP1 and the problem was solved. Even the Literal was no longer needed. The original code above works Ok now.

I recommend however that you first test the servicepack in a non production environment however. This is a best practice for installing any service pack. Sometimes a service pack breaks more (by being more restrictive for security, for example), than it solves in your specific situation.

First blog entry

Hi you all,

I'm Schprit, system administrator and beginning developer from the Netherlands.
I'm 36 years old (at the moment I'm writing this entry at least...).
I'm maried and have a lovely daughter of 16 months old.

Well that's all about me.

In this blog I will write about the things I see in my work and study that frap me, or at least that I find interesting.