I'm writing a script in powershell to lockdown a cloud environment website application. I have installed SSL, created groups/users in AD, disabled users, disabled app pools and and created app pools to summarize the script. Win 2008 r2 / iis7. When testing the site, I am getting a "403 Forbidden: Access is denied" When I check the system logs, I see the following three messages:
Level: Error
Source: WAS
Event ID: 5059
Application pool RiskChecker has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool.
Level: Warning
Source: WAS
Event ID: 5057
Application pool RiskChecker has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid.
Level: Warning
Source: WAS
Event ID: 5021
The identity of application pool XYZAppPool is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.
What do these messages mean, and can anyone point me in the direction of how to resolve this? Thank you.
Best Answer
as monojlds says it's a credential issue - the error means the credentials you have entered for the app pool are incorrect or not in the right group.
is it a local user or a domain user? maybe the box can't authenticate against the domain being used? could the account be locked out? (that last one used to get me a lot)
on the IIS server you can test the credentials using
runason the command prompt.it'll ask for you password and either launch another cmd or provide an error message. That'll help troubleshoot the user credentials.
Matt