Error: Access is denied" to the Temporary ASP.NET files when registering to a task server

Products

• IT Management Suite
• Task Server

Issue/Introduction

Unable to register to one or more task servers in the environment and the Windows Event Application Logs show:

Could not write to output file 'c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\altiris_clienttaskserver\a031058b\3df50a20\App_global.asax.owzyhk7c.dll' -- 'Access is denied.'

Task Server agent logs show:

"HTTP status 500: An unexpected condition prevented the server from fulfilling the request"

Windows Event Log, Application:

Event code: 3007
Event message: A compilation error has occurred.
Event time: 12/6/2018 4:47:29 PM
Event time (UTC): 12/6/2018 10:47:29 PM
Event ID: 6b91bd6252b04228af81d6bf90429ec0
Event sequence: 3
Event occurrence: 1
Event detail code: 0

Application information:

    Application domain: /LM/W3SVC/1/ROOT/Altiris/ClientTaskServer-1022-131886100497077214
    Trust level: Full
    Application Virtual Path: /Altiris/ClientTaskServer
    Application Path: e:\program files\altiris\Altiris Agent\Client Task Server\ServerWeb\
    Machine name: [HOST NAME]

Process information:

    Process ID: 9912
    Process name: w3wp.exe
    Account name: IIS APPPOOL\Symantec Task Server AppPool

Exception information:

    Exception type: HttpCompileException Exception message: (0): error CS0016: Could not write to output file 'c:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\altiris_clienttaskserver\a031058b\3df50a20\App_global.asax.owzyhk7c.dll' -- 'Access is denied. 
   at System.Web.Compilation.AssemblyBuilder.Compile()
   at System.Web.Compilation.BuildProvidersCompiler.PerformBuild()
   at System.Web.Compilation.ApplicationBuildProvider.GetGlobalAsaxBuildResult(Boolean isPrecompiledApp)
   at System.Web.Compilation.BuildManager.CompileGlobalAsax()
   at System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled()
   at System.Web.Compilation.BuildManager.CallAppInitializeMethod()
   at System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters, PolicyLevel policyLevel, Exception appDomainCreationException)

Request information:

    Request URL: http://[FQDN]/Altiris/ClientTaskServer/Register.aspx?lastResort=true&resourceGuid=5144204e-785f-4c09-a60f-91c4cde0af8d&crc=000800010000149C
    Request path: /Altiris/ClientTaskServer/Register.aspx
    User host address: xx.xx.xx.xx
    User:
    Is authenticated: False
    Authentication Type:
    Thread account name: IIS APPPOOL\Symantec Task Server AppPool

Thread information:

    Thread ID: 1001
    Thread account name: IIS APPPOOL\Symantec Task Server AppPool
    Is impersonating: False
    Stack trace:    at System.Web.Compilation.AssemblyBuilder.Compile()
   at System.Web.Compilation.BuildProvidersCompiler.PerformBuild()
   at System.Web.Compilation.ApplicationBuildProvider.GetGlobalAsaxBuildResult(Boolean isPrecompiledApp)
   at System.Web.Compilation.BuildManager.CompileGlobalAsax()
   at System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled()
   at System.Web.Compilation.BuildManager.CallAppInitializeMethod()
   at System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters, PolicyLevel policyLevel, Exception appDomainCreationException)

Environment

ITMS 8.x

Cause

This happend with task servers running on Windows 2012 R2, and extensive network monitoring and hardening procedures in place. Permissions were lost or not present on the temp folders needed for Task Service to function.

Resolution

Try the following:

1. Add  "IIS_IUSRS" user to the "C:\Windows\Temp" and "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files" folders with the following permissions:

   • "C:\Windows\Temp"  Special Permissions, with List folder / read data

   • "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files" Everything but Full control; Special Permissions all but Full control

2. After making the changes, run an IISRESET at the command line,

3. Check that the task server started accepting client task registrations.