Problem with Shadow Folders and Custom .NET Account

[TC]

I seem to have no luck with shadow folders.

I'm using Windows 2003 Server and IIS 6.0. I am trying to get shadow folders to work by creating a custom .NET account (per the instructions at http://support.sourcegear.com/viewtopic.php?t=188). My server is not on a domain and the shadow folders are local, so I have interpreted the instructions accordingly. I have created an account called "vault_shadow", configured it as a member of IIS_WPG, and used local security policies to give it permission to "Access this computer from the network", "log on as a batch job", "log on as a service", "allow log on locally", and "allow log on through Terminal Services". When I reach step c and try to log in with that account, however, I get the error "You do not have access to logon to this Session". At this point, I'm stumped. I don't know what that error means, nor how to get past it. Can anyone offer any advice?

I should mention that shadow folders have been a bugaboo for me. I struggled with them for a long time, and finally got them to work in IIS 5.0 Isolation Mode. Unfortunately, I discovered that IIS 5.0 Isolation mode caused website emails to fail. Email is a critical feature of the website, so I was forced to turn IIS 5.0 Isolation Mode off. Now emails work, but shadow folders don't.


-TC

[mskrobul]

Is your shadow folder location on the Vault server?

You may try changing the cache file location as opposed to using the custom identity if you are shadowing to a location on the same machine as the server. There are problems with custom identity and shadow folders in versions >= 3.1 that will be fixed in the next release.

In previous versions of Vault you needed to use a custom identity with IIS 6.0 because Network Service (which is what IIS 6.0 runs the ASPNET process as) doesn't have an %appdata% folder where the shadow folder cache files are kept.

In current versions of Vault you can choose a different location for the shadow folder cache files. You *should* be able to uncomment the shadowfolder_cachepath key in the shadow folder web.config file and set that value to a valid path on the vault server machine. Make sure that Network Service has permissions to that folder then re-configure your shadow folders (note that the cache path must exists with the correct permissions and the custom identity part of web.config should be commented out before you re- configure the shadow folders).

If you do this, you should be able to get shadow folders to work in IIS 6.0 without using the custom identity.

The problems with custom identity and shadow folders will be fixed in the 3.1.3 release which should be out within the next few weeks.

[TC.]

Mary Jo,

Thank you for the advice. With your suggestions, I was able to get shadow folders working again.

In doing so, I found that I had to give NETWORK SERVICE broad permissions on my web folders. Am I compromising security by doing that?


-TC

[mskrobul]

When you say "web folders" which folders are you talking about? Did you put the cache location under wwwroot or are your shadow folder destinations under wwwroot?

I am not sure if there are any increased security risks or not using Network Service as opposed to a custom account (or the ASPNET account). If you feel safer using a custom account we should have Vault 3.1.3 out soon which will have a fix for the shadow folder custom account problem.