IIS Hardening Causing 401 Unauthorized or API Errors in the Console

Products

• Carbon Black App Control

Issue/Introduction

Page errors displayed when accessing URLs similar to:

• 401 - Unauthorized: Access is denied due to invalid credentials.
• You are not authorized to view this page.
• An error occurred while processing your request. See the error log for more details.
• API authentication failed. Some pages will not be functional. Please try to log out and log in again.
• Your API session has expired.

• Server Error in '' Application.
  
  Access is denied.
  
  Error message 401.2.: Unauthorized: Logon failed due to server configuration.  Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server.  Contact the Web server's administrator for additional assistance.

Environment

• App Control Console: All Supported Versions
• Microsoft IIS: All Supported Versions

Cause

The following IIS hardening configurations have been added recently:

• NET Authorization Rules > Allow All Users was removed or replaced with specific User or a Group
• NET Authorization Rules > Deny Anonymous Users rule was added

Resolution

Warning: App Control has not been tested with IIS Hardening configurations. Some IIS hardening changes could potentially break the web console.

1. Log in to the application server an Admin account
2. Launch IIS Manager: Start > Run > inetmgr
3. Select the application server name on the left-hand side
4. Double-click the .NET Authorization Rules icon
5. Verify that the Allow Authorization Rule for All Users is the only one present
6. Repeat the same by selecting the Parity Console Web on the left
7. Save changes and attempt to access the URL once more