v4.1.4: difference in web.config files

[kha]

My production server web.config: which is in domain "Domain1"
<!-- IMPERSONATEPROCESS-identity impersonate="true" userName="AAAAAAAA" password="BBBBBBBB"/>IMPERSONATEPROCESS- -->

My staging web.config: which is not in domain, just in WORKGROUP
<identity impersonate="true" userName="domain2\runtask" password="password"/>

My question: Why are they different? When installed Vault server on these 2 servers, I choosed "custom" for IIS Process Model

[Beth]

The answer should be found in your vault_install.log on each machine. By default that is in %username%/local settings/temp if it's Windows 2003. Compare those two and see what you have.

[kha]

what should I look for in the install log file?

[kha]

This is what I found:

Production server vault_install.log:

Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user SERV-SOURCECTRL\ASPNET
Using SERV-SOURCECTRL\ASPNET as the user.
GrantPermissions completed successfully.
Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user NT AUTHORITY\NETWORK SERVICE
Using NT AUTHORITY\NETWORK SERVICE as the user.
GrantPermissions completed successfully.
Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user SERV-SOURCECTRL\IWAM_SERV-SOURCECTRL
Using SERV-SOURCECTRL\IWAM_SERV-SOURCECTRL as the user.
Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user SERV-SOURCECTRL\IUSR_SERV-SOURCECTRL
Using SERV-SOURCECTRL\IUSR_SERV-SOURCECTRL as the user.
Adding NT AUTHORITY/NETWORK SERVICE to IIS_WPG
Exception The specified account name is already a member of the local group. (Exception from HRESULT: 0x80070562)


This is from staging server vault_install.log

Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user domain2\runtask
Error granting permissions. Some or all identity references could not be translated.
Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user VMSGTEST\IWAM_VMSGTEST
Using VMSGTEST\IWAM_VMSGTEST as the user.
Adding permission to 'C:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\vaultshadowfolder' for user VMSGTEST\IUSR_VMSGTEST
Using VMSGTEST\IUSR_VMSGTEST as the user.
Adding domain2/runtask to IIS_WPG
Exception A member could not be added to or removed from the local group because the member does not exist. (Exception from HRESULT: 0x8007056B)

[Beth]

The top one would usually come from choosing the machine IIS process model. Do you have a user similar to domain2\runtask anywhere in the production server Vault install log?

[kha]

Beth,

You are right. The production server did not use "custom" (but "machine") for IIS Process Model. domain2/runtask user is not in anywhere in vault_install.log on production server.

I found out that since SQL server and Vault Server are not in the same domain, the "custom" method doesn't work for us. So, we used "machine" method instead.

Thanks for your help.

[Beth]

Thanks for the update.