IIS – Tracing Web requests/resposes

I've run into this exact issue several times, and every time, the solution was to:

1. go to the Control Panel
2. go to the "Windows Components" area
3. remove IIS, let it uninstall
4. reboot
5. re-add IIS (make sure to include the ASP.NET stuff when you check off the boxes).
6. Run: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regiis.exe -I

I spent hours debugging this at a client site once, and that was the trick. Since then, every time this has happened, this was the fix.

I'm not sure what the root cause is, but we tore the IIS configuration apart once trying to figure it out, and even had Microsoft RDC'ing into the server in question for 2 or 3 hours, and they couldn't help either.

So I write it off as an undocumented bug in ASP.NET/IIS.

With Failed Request Tracing, you need to setup the rule, but as a separate step you must turn it on. In the Failed Request Tracing, check the Action pane on the right, that will have an option to enable it. That's my guess as to why the tracing isn't working.

My recommendation on any configuration in IIS7 where you have 1 site per app pool, or when all sites trust each other and the sites are stable, is to set Anonymous authentication to use the identity of the app pool. That gives you one less user to deal with. Then make sure that the app pool identity is granted permission on disk.

You mention that it doesn't work in the subfolder. It is possible to have different permissions or a different app pool used for a sub-application. Double check the app pool being used, and anonymous auth settings.

Finally, use Process Monitor as Colin suggested. Get it from www.sysinternals.com. It's free, safe to run on a production server and you'll figure it out in under 10 minutes. That will tell you exactly which user is denied access to which folder (or registry key).