文章編號: 946139 - 上次校閱: 2008年2月20日 - 版次: 1.1

將執行 IIS 7.0 的 Windows Server 2008 電腦設定為網域控制站之後,您無法解析內建的 IIS 帳戶

系統提示本文適用於您使用的作業系統之外的作業系統。與您不相關的文章內容已停用。
全部展開 | 全部摺疊

徵狀

試想下列案例。您具備執行 Internet Information Services (IIS) 7.0 的 Windows Server 2008 伺服器。您將 Windows Server 2008 伺服器設定為 Windows 2000 網域或 Windows Server 2003 網域的網域控制站。在這種情況下,您無法解析內建的 IIS 帳戶,例如 IIS_IUSRS 群組或 IUSR 來賓使用者帳戶。您只會看到內建 IIS 帳戶的原始安全性識別元 (SID)。

注意 如果您將 Windows Server 2008 伺服器設定為 Windows Server 2008 網域的網域控制站,就不會發生這個問題。

發生的原因

之所以發生這個問題,是因為 Windows Server 2008 的 IIS 7.0 內建帳戶規格不存在於舊版的網域中,例如 Windows 2000 網域和 Windows Server 2003 網域。當 IIS 7.0 伺服器設定為 Windows 2000 網域控制站或 Windows Server 2003 網域控制站時,就無法解析 Windows Server 2008 帳戶。

解決方案

如果要解決這個問題,請使用下列範例指令碼。

注意 執行這個指令碼之後,您必須重新啟動伺服器。
/*
   SamUpgradeTask.js
   (c) 2007, Microsoft Corp.
*/
 
// Check the version of the operating system. Stop the script if the version is earlier than 6.
if ( ! CheckOSVersion() )
{
    WScript.Echo("ERROR: This script will only work on Longhorn Server or above.");
    WScript.Quit(1);
}
 
// Retrieve the local computer's rootDSE LDAP object.
var localRootDse = null;
 
try
{
    localRootDse = GetObject("LDAP://localhost/rootDSE");
}
catch(e)
{
    WScript.Echo("There was an error attempting to retrieve the localhost RootDSE object.");
    WScript.Echo("Perhaps this machine is not a Domain Controller on the network?");
    WScript.Echo("ErrorCode: " + e.number);
    WScript.Quit(1);
}
 
// Retrieve several rootDSE properties
var dnsHostName = localRootDse.Get("dnsHostName");
var dsServiceName = localRootDse.Get("dsServiceName");
var defaultNamingContext = localRootDse.Get("defaultNamingContext");
 
// Open the default naming context
var ncObj = GetObject("LDAP://" + defaultNamingContext);
 
// Get the "FSMO Role Owner"
var strfsmoNtdsa = ncObj.FsmoRoleOwner;
var fsmoNtdsaObj = GetObject("LDAP://" + strfsmoNtdsa);
 
// Get the parent object of "FSMO Role Owner"
var fsmoServerObj = GetObject(fsmoNtdsaObj.Parent);
 
// By using the Server Reference, retrieve the name of the PDC computer
var strFsmoComputer = fsmoServerObj.ServerReference;
var fsmoComputerObj = GetObject("LDAP://" + strFsmoComputer);
var pdcName = fsmoComputerObj.Get("name");
 
// Get the RootDSE object for the PDC
var pdcRootDse = GetObject("LDAP://" + pdcName + "/rootDSE");
 
// Check whether the PDC is a legacy domain or not.
var domainControllerFunctionality = pdcRootDse.Get("domainControllerFunctionality");
 
if ( domainControllerFunctionality > 2 )
{
    WScript.Echo("Domain is already operating in a mode higher than Windows Server 2003 mode. Stopping script execution.");
    WScript.Quit(0);
}
 
// Get the default naming context for the PDC
var pdcDefaultNamingContext = pdcRootDse.Get("defaultNamingContext");
 
// Retrieve the well known object from the PDC
var pdcSystem = GetObject("LDAP://" + pdcName + "/<WKGUID=AB1D30F3768811D1ADED00C04FD8D5CD," + pdcDefaultNamingContext + ">");
 
// Get the distinguished name for the well known object
var pdcDistinguishedName = pdcSystem.Get("distinguishedName");
 
// Check whether the task has already been run
var taskMarker = null;
 
try
{
    taskMarker = GetObject("LDAP://" + pdcName + "/<WKGUID=6ACDD74F3F314ae396F62BBE6B2DB961,CN=Server," + pdcDistinguishedName + ">");
}
catch(e)
{
    if ( e.number == -2147016656 ) // Check and see if error code is ERROR_DS_NO_SUCH_OBJECT
    {
        taskMarker = null;
    }
    else
    {
        WScript.Echo("Error attempting to retrieve well known object from PDC.");
        WScript.Echo("Name: " + e.name + "\nDescription: " + e.description + "\nCode: " + e.number + "\nMessage: " + e.message);
        WScript.Quit(1);
    }
}
 
// If the well known object exists, the SAM upgrade is already running. Therefore, stop the script.
if ( taskMarker != null )
{
    WScript.Echo("SAM upgrade task already being run. No work done.");
    WScript.Quit(1);
}
 
// Get the Server container with that distinguished name
var serverObj = GetObject("LDAP://" + pdcName + "/CN=Server," + pdcDistinguishedName);
 
// Prepare a safe array (for example, VBArray) with one entry
var jsArray = new Array(1);
jsArray[0] = "B:32:6ACDD74F3F314ae396F62BBE6B2DB961:"+ dsServiceName;
var vbArray = JS2VBArray(jsArray);
 
try
{
    // Append an entry to the "Other-Well-Known-Objects" attribute for the 
    // previous server object.
    serverObj.PutEx(3, "otherWellKnownObjects", vbArray);
    serverObj.SetInfo();
}
catch(e)
{
    WScript.Echo("Unexpected error attempting to put the well known GUID.");
    WScript.Echo("ErrorCode: " + e.number);
}
 
WScript.Echo("Running upgrade task.");
// Set the "runSamUpgradeTasks" attribute in the local rootDSE
localRootDse.Put("runSamUpgradeTasks", 1);
localRootDse.SetInfo();
 
// Remote the binary data from the previous well known object entry 
serverObj.PutEx(4, "otherWellKnownObjects", vbArray);
serverObj.SetInfo();
 
// The upgrade is complete.
WScript.Echo("Done!");
 
function CheckOSVersion()
{
    var wbemFlagReturnImmediately = 0x10;
    var wbemFlagForwardOnly = 0x20;
 
    var objWMIService = GetObject("winmgmts:\\\\.\\root\\CIMV2");
    var colItems = objWMIService.ExecQuery("SELECT * FROM Win32_OperatingSystem", "WQL",
                                      wbemFlagReturnImmediately | wbemFlagForwardOnly);
 
    var enumItems = new Enumerator(colItems);
    for (; !enumItems.atEnd(); enumItems.moveNext()) {
        var objItem = enumItems.item();
        var fullVersion = objItem.Version;
        var indexPoint = fullVersion.indexOf(".");
 
        if ( indexPoint == -1 )
        {
            return false;
        }
 
        var majorVersion = fullVersion.substring(0, indexPoint);
 
        return (majorVersion >= "6");
    }
 
    return false;
}
 
function JS2VBArray( objJSArray )
{
    var dictionary = new ActiveXObject( "Scripting.Dictionary" );
    for ( var i = 0; i < objJSArray.length; i++ )
    {
        dictionary.add( i, objJSArray[ i ] );
    }
 
    return dictionary.Items();
}

狀況說明

這是原本設計的做法。

這篇文章中的資訊適用於:
  • Microsoft Internet Information Services 7.0
關鍵字:?
kbtshoot kbprb kbexpertiseinter KB946139
Microsoft及(或)其供應商不就任何在本伺服器上發表的文字資料及其相關圖表資訊的恰當性作任何承諾。所有文字資料及其相關圖表均以「現狀」供應,不負任何擔保責任。Microsoft及(或)其供應商謹此聲明,不負任何對與此資訊有關之擔保責任,包括關於適售性、適用於某一特定用途、權利或不侵權的明示或默示擔保責任。Microsoft及(或)其供應商無論如何不對因或與使用本伺服器上資訊或與資訊的實行有關而引起的契約、過失或其他侵權行為之訴訟中的特別的、間接的、衍生性的損害或任何因使用而喪失所導致的之損害、資料或利潤負任何責任。