calin radoni's humble web presence

home

docs

toolbox

about

IISADMIN failed to start with a stupid error: 2147549183

Introduction
Symptoms
Cause
Solution
History
Copyright and License
Disclaimer

Introduction

In Windows Server 2003, a GPO defines the startup type for IISADMIN service as Automatic but IISADMIN refuses to start on a Windows XP machine for which that GPO is applied.

Symptoms

In Event Log -> System is logged the event:

Type: Error
Source: Service Control Manager
Category: None
Event: 7024
User: N/A

which contains:

The IIS Admin service terminated with service-specific error 2147549183 (0x8000FFFF).

and, only if Failure of Object Access auditing is enabled, in Event Log -> Security is logged the event:

Type: Failure Audit
Source: Security
Category: Object Access
Event: 560
User: NETWORK SERVICE

with a content similar to:

Object Open:
 	Object Server:        SC Manager
 	Object Type:          SERVICE OBJECT
 	Object Name:          IISADMIN
 	Handle ID:            -
 	Operation ID:         {0,3789036}
 	Process ID:           876
 	Image File Name:      C:\WINDOWS\system32\services.exe
 	Primary User Name:    xxxComputerNamexxx$
 	Primary Domain:       xxxDomainNamexxx
 	Primary Logon ID:     (0x0,0x3E7)
 	Client User Name:     NETWORK SERVICE
 	Client Domain:        NT AUTHORITY
 	Client Logon ID:      (0x0,0x3E4)
 	Accesses:             READ_CONTROL 
				Query service configuration information 
				Query status of service 
				Enumerate dependencies of service 
				Query information from service 
			
 	Privileges:           -
 	Restricted Sid Count: 0

Cause

If you read carefully the content of EventID 560 you will see that IISADMIN tries to do some things (see Accesses) under the NETWORK SERVICE account and fails. This thing has lead me to examine the permissions for the IISADMIN service. As expected, there was no mention about NETWORK SERVICE.

Solution

The presence of EventID 560, related to the EventID 7024, has leaded me to the following solution:

Find the GPO that configure the IISADMIN service. If you do not know how to do this, read my tip How to find the settings applied through GPO in Windows XP which deals with what his title says (this was a tough sentence...).
Go to your Domain Controller.
1. Edit the GPO that configure the IISADMIN service
2. Go to Computer Configuration -> Windows Settings -> Security Settings -> System Services
3. Right click IISADMIN and choose Properties
4. Select Define this policy setting
5. For Select service startup mode choose Automatic
6. Click Edit Security ...
7. Add NETWORK SERVICE with Read permission.
Go back to your computer.
1. Force the refreshing of policies by typing at a command prompt gpupdate /force
2. Open Computer Management -> Services
3. Select IISADMIN
4. Start the service
5. Now those events must not be logged again and IISADMIN should work.

This solution has solved the problem in my case.

History

21 June 2005, First version.

Copyright and License

Disclaimer

No liability for the contents of this document can be accepted. Use the concepts, examples and information at your own risk. There may be errors and inaccuracies that could be damaging to your system. Proceed with caution, the author do not take any responsibility.

All copyrights are held by their respective owners, unless specifically noted otherwise. Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark. Naming of particular products or brands should not be seen as endorsements.

Hosted on http://www.oocities.org/calinradoni

Last page modification is 21 June 2005