I have permission error when deploy the build on the IIS

manager_7279

Its .NET app and build are working fine but when I tried to deploy it on IIS I got this error.
I have given full permission to the site folder as well but still the same error. I am using Windows Server 2019 Standard.
I tried to use IIS::Stop-Site Script as well but same error there as well.

Error: Unhandled exception: System.UnauthorizedAccessException: Access is denied. (0x80070005 (E_ACCESSDENIED))
at Microsoft.Web.Administration.Interop.IAppHostProperty.get_Value()
at Microsoft.Web.Administration.ConfigurationElement.GetPropertyValue(IAppHostProperty property)
at Microsoft.Web.Administration.ApplicationPool.get_State()
at Inedo.Extensions.Windows.Operations.IIS.AppPools.AppPoolJob.StopAppPoolAsync(ApplicationPool pool, CancellationToken cancellationToken) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp_E361574\Src\Windows\InedoExtension\Operations\IIS\AppPools\AppPoolJob.cs:line 104
at Inedo.Extensions.Windows.Operations.IIS.AppPools.AppPoolJob.ExecuteAsync(CancellationToken cancellationToken) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp_E361574\Src\Windows\InedoExtension\Operations\IIS\AppPools\AppPoolJob.cs:line 37
at Inedo.Agents.LocalJobExecuter.ExecuteJobAsync(RemoteJob job, CancellationToken cancellationToken)
at Inedo.BuildMaster.Windows.ServiceApplication.Executions.PlanExecuter.OtterScriptExecuter.Inedo.ExecutionEngine.Executer.IExecutionHostEnvironment.ExecuteActionAsync(ActionStatement actionStatement, IExecuterContext context)

atripp

Hi @manager_7279 ,

Stopping/Starting IIS application pools requires administrative access. Looking at your stack trace, it seems like you're trying to stop an application pool on localhost (i.e. the server that BuildMaster is running on)?

That's not a common requirement; instead you'd stop/start an application on a different server.

In any case, the BuildMaster service runs under NETWORK SERVICE, and will not have permission to modify IIS application pools on localhost. So if you plan to do this (i.e. stop/start IIS on localhost), then you will need to make the BuildMaster server run under LOCAL SYSTEM instead of NETWORK SERVICE.

This will likely also require you to update database permissions, to allow LOCAL SYSTEM to connect to the database as well.

Alana

manager_7279

Hi @atripp,
Thank you so much for your answer. Actually, I am trying to stop the IIS Pool (that is connected to only 1 site) without stopping IIS pool I can't deploy artifact files.
I tried to change the BuildMaster Service and BuildMaster Web Server to run under Local System Account but after restart service BuildMaster web app not running so I have to revert it back.

Any suggestion?

Thank you!

atripp

Hi @manager_7279 ,

This is likely because of a lack of database permissions; you'll need to grant permissions to the BuildMaster database in the local SQL Server database. We don't have a step-by-step guide for that, but it involves giving that user BuildMasterUser_Role permission using something like SQL Server Management Studio.

As an alternative, you can install the Inedo agent on the BuildMaster server (defaults to Local System) and then connect to that instead of localhost.

Cheers,
Alana

manager_7279

@atripp Thank you! I was able to fix that issue. After changing the service to "Local system account" I gave full permission of Buildmaster database for the user "NT AUTHORITY\SYSTEM"