Unauthorized 401 IIS and other similar errors in Notification Server

book

Article ID: 180284

calendar_today

Updated On:

Products

Management Platform (Formerly known as Notification Server)

Issue/Introduction

 

Resolution

Problem

When reviewing error logs, you may see a variety of error messages similar to the following:

  • SendBasicInventory failed: HTTP error: 401 Unauthorized (-2147209951)
  • CoNetworkTransport(116), Description: HTTP error: 401 Unauthorized (-2147209951)
  • Error while sending event: HTTP Request Failed: No connection could be made because the target machine actively refused it. -2147014835

Environment
Notification Server 6.0
Altiris Agent 6.0 versions

Cause

There is an account or password synchronization problem with the account that IIS is using for anonymous access. The error code 2148074252 found in the log translates to “The logon attempt failed.”

Resolution

You will need to synchronize the IUSR_machinename account and passwords with IIS to rectify the problem. Steps on how to do this can be found here. Text from the article is quoted below:

 

Symptoms

When you browse to an existing Active Server Pages (ASP) page, the browser may return an “HTTP 500 - Internal server error” or “Server Application Error” message. If you review the server's System Event Log after you receive the error message, two entries appear:

Source: W3SVC

Error: Configured identity is incorrect

 

and

 

Source: DCOM

Error: Unable to logon IWAM_ComputerName.

If you enable only Basic Authentication for the application and set the Application Protection to “Low,” the application starts to work again as expected. In addition, if you create a new ASP application after you receive this error, you can browse to it without any errors.

 

Related Error Messages

You may also receive the following error messages:

In your browser:

HTTP 500 - Internal server error

or

Server Application Error
The server has encountered an error while loading an application during the processing of your request. Please refer to the event log for more detail information. Please contact the server administrator for assistance.

 

In the System Event Log:

 

Source: DCOM
Error: DCOM got error "Logon Failure: unknown username or bad password" Unable to logon .\IWAM_SERVERNAME in order to run the server.

 

and

 

Source: W3SVC
Error: "The server failed to load application '/LM/W3SVC/1/Root/op.' The error was 'The server process could not be started because the configured identity is incorrect. Check the username and password.

 

or

 

Source: W3SVC Error: "The server failed to load application '/LM/W3SVC/4/Root'. The error was 'c000003b'."

 

and

 

Source: W3SVC Error: “The COM Application '{3D14228D-FBE1-11d0-995D-00C04FD919C1}' at '/LM/W3SVC/4/Root' failed to activate out of process.”

Note: The error message is seen in Microsoft Internet Information Services 6.0 (IIS 6.0) if the Run WWW service in IIS 5.0 isolation mode check box is selected. See the “More Information” section of the [Microsoft] article for steps to select the Run WWW service in IIS 5.0 isolation mode check box.

 

Cause

User names and passwords for the IUSR_ComputerName and IWAM_ComputerName accounts are stored in three locations:

Internet Information Server (IIS) metabase

 User Manager for Domains (Windows NT) or Local Users and Groups (Windows 2000)

Microsoft Transaction Server (Windows NT) or Component Services (Windows 2000)

 

If the user names and/or passwords are not synchronized among these three locations, you will receive the above-mentioned error messages.

 

Resolution

To resolve this problem, you must make sure that the passwords for the IUSR and IWAM accounts are synchronized in all three of the above-mentioned locations. There are two ways to achieve this: you can set the password for IWAM and IUSR accounts in User Manager (Windows NT) or Users and Groups (Windows 2000) and change the passwords in IIS metabase to reflect the same password, or vice versa. Use one of the following methods to synchronize the passwords:

 

Note: Please refer to the “More Information” section for instructions on how to use the Administration Script Utility (Adsutil.vbs) and how to change the password in Microsoft Transaction Server (MTS) or Component Services.

 

Method 1: Change the passwords in User Manager or Users and Groups to match the IIS metabase password.

 

1.   In the Command window, locate the folder that contains the Adsutil.vbs file. Use the Adsutil.vbs tool to obtain the passwords for the IWAM and IUSR accounts from the IIS metabase.

2.   To change the IUSR and/or IWAM passwords in Windows NT, follow these steps:

a.   From the Start menu, point to Programs, point to Administrative Tools, and then click User Manager for Domains. In User Manager for Domains, you can change the account information for all Windows NT user accounts and groups.

b.   Double-click the IUSR_ComputerName and/or IWAM_ComputerName users and modify the passwords so that they reflect the IIS metabase password that you obtained in step 1.

 

To change the IUSR and/or IWAM passwords in Windows 2000, follow these steps:

a.   From the Start menu, point to Programs, point to Administrative Tools, and then click on Computer Management.

b.   Under the System Tools node, click to expand the Local Users and Groups and Users nodes. In the User node, you can change the account information for all Windows 2000 user accounts and groups.

c.   Right-click the IUSR_ComputerName and/or IWAM_ComputerName accounts, and then click Set Password.

d.   Modify the passwords so that they reflect the IIS metabase password that you obtained in step 1.

3.   Browse to the ASP page that returned the error message to check if the problem has been resolved.

 

Method 2: Change the IIS metabase to match the IUSR and/or IWAM passwords.

 

1.   To change the IUSR and/or IWAM password in Windows NT, follow these steps:

 

a.   From the Start menu, point to Programs, point to Administrative Tools, and then click User Manager for Domains. In User Manager for Domains, you can change the account information for all Windows NT user accounts and groups.

b.   Double-click the IUSR_ComputerName and/or IWAM_ComputerName accounts, and type new passwords.

To change the IUSR and/or IWAM password in Windows 2000, follow these steps:

a.   From the Start menu, point to Programs, point to Administrative Tools, and then click Computer Management.

b.   Under the System Tools node, click to expand the Local Users and Groups and Users nodes. In the User node, you can change the account information for all Windows 2000 user accounts and groups.

c.   Right-click the IUSR_ComputerName and/or IWAM_ComputerName accounts, and then click Set Password. Type new passwords.

 

2.   In the Command window, locate the folder that contains the Adsutil.vbs file. Use the Adsutil.vbs utility to set the passwords for the IWAM and IUSR accounts in the IIS metabase.

3.   Browse to the ASP page that returned the error message to check if the problem has been resolved.

 

Note: Although the passwords in Microsoft Transaction Server (Windows NT) and Component Services (Windows 2000) usually match the IIS metabase, update the IWAM password in Microsoft Transaction Server (MTS) or Component Services if the problem still occurs. For more information, see the “How to Change the Password in MTS or Component Services” portion of the “More Information” section.