DCPROMO does not retain permissions on some IIS folders

When you promote a Microsoft Windows Server 2003 member server to a domain controller, if Internet Information Services (IIS) is installed on the server, you may see the following symptoms:

• No compressed files are stored in the temporary folder (also known as the cache directory), even though a client that supports HTTP compression has requested them.
• No files are cached in the ASP Compiled Templates folder.

For security reasons, IIS should not be installed on domain controllers.

The operation that promotes a member server to a domain controller (DCPromo.exe) resets permissions on some folders. The Access Control Lists (ACLs) for three folders are not set correctly during this operation.

You may also see the following in your application event log:

Source : Active Server Pages

Event ID: 5

Error: The Template Persistent Cache initialization failed for Application Pool" AppPoolName: because of the following error: Could not create a Disk Cache Sub-directory for the Application Pool. The data may have additional error codes:

If you view permissions on the following folders, you will see that the IIS_WPG and the NT AUTHORITY\NETWORK SERVICE groups do not have permissions on these folders:

• systemroot\Help\IISHelp\Common
• systemroot\System32\Inetsrv\ASP Compiled Templates
• systemroot\IIS Temporary Compressed Files

Manually set permissions on the folders

1. Click Start, click Windows Explorer, double-click My Computer, double-click the system drive (this is typically drive C), and then double-click WINDOWS or WINNT.
2. Double-click Help, double-click iisHelp, right-click common, and then click Sharing and Security.
3. Click Security, click Add, type IIS_WPG, and then click OK.
4. With IIS_WPG selected, click to select the following check boxes, and then click OK:
   • Read and Execute
   • List Folder Contents
   • Read
5. Open the Sharing and Security dialog box for the systemroot\system32\inetsrv\ASP Compiled Templates folder, and then grant Full Control to the IIS_WPG group.
6. Repeat step 5 for the systemroot\IIS Temporary Compressed Files folder.

To manually set the permission for NT AUTHORITY\NETWORK SERVICE, follow these steps:

1. Click Start, click Run, type %systemroot%\Help\iisHelp, and then click OK.
2. Right-click the Common folder, and then click Sharing and Security.
3. On the Security tab, click Add, type NETWORK SERVICE, and then click OK.
4. Click NETWORK SERVICE, click to select the following check boxes under Allow, and then click OK:
   • Read and Execute
   • List Folder Contents
   • Read
5. Click Start, click Run, type %systemroot%\system32\inetsrv, and then click OK.
6. Right-click the ASP Compiled Templates folder, and then click Sharing and Security.
7. On the Security tab, click Add, type NETWORK SERVICE, and then click OK.
8. Click NETWORK SERVICE, click to select the Full Control check box under Allow, and then click OK
9. Click Start, click Run, type %systemroot%, and then click OK.
10. Right-click the IIS Temporary Compressed folder, and then click Sharing and Security.
11. On the Security tab, click Add, type NETWORK SERVICE, and then click OK.
12. Click NETWORK SERVICE, click to select the Full Control check box under Allow, and then click OK

After you have completed these steps, restart the IIS Admin Service. To do this, follow these steps:

1. Click Start, click Run, type Services.msc, and then click OK.
2. Right-click IIS Admin, and then click Restart.

Microsoft has confirmed that this is a problem in Microsoft Windows Server 2003.

For more information about HTTP Compression and ASP Template caching, see the product documentation. To view this documentation, visit the following Microsoft Web sites:You can also access the product documentation through IIS Manager. For more information about how to access this Help feature, click the following article number to view the article in the Microsoft Knowledge Base: