After you install the patch, you receive the following error message when any request is made to ASP.NET:
The following table lists the operating systems and the versions of the Microsoft .NET Framework that are affected by this bug:
|.NET Framework Version||Operating System||Affected|
|1.0||Windows 2000 Professional||No|
|1.0||Windows 2000 Server||No|
|1.0||Windows XP Professional||Yes|
|1.0||Windows Server 2003||No|
|1.1||Windows 2000 Professional||No|
|1.1||Windows 2000 Server||No|
|1.1||Windows XP Professional||No|
|1.1||Windows Server 2003||No|
- Stops the IIS and the ASP.NET state services.
- Deletes and then re-creates the ASPNET account by using a known temporary password.
- Uses the Windows runas command to start an executable that creates an ASPNET user profile. An ASPNET user profile works around the issue.
- Reregisters ASP.NET. This step creates a new random password for the account and applies default ASP.NET access control settings for the account.
- Restarts the Microsoft Internet Information Services (IIS) service.
- The batch file may fail if the hard-coded password does not meet the password complexity requirements in your environment. If this problem occurs, you can change the password to another value that is appropriate for your environment.
- If you have added custom access control settings or database account permissions for the ASPNET account, you must re-create these settings or permissions after this batch file has completed. This is because a new security identifier (SID) is assigned to this account when the account is re-created.
- If you are running the ASP.NET worker process by using a custom account that is different from the ASPNET account, do not run this batch file. Instead, you must log on to the computer interactively or you must use the runas command with that custom account. This procedure creates a user profile for the custom account.
Note Your account must be a member of the Administrators group.
- Start Notepad. Verify that Word Wrap is turned off.
- Paste the batch file code in Notepad.
- Save the file as
- Click Start, and then click
- Type cmd.exe, and then press ENTER.
- At the command prompt, type
c:\fixup.cmd, and then press ENTER.
- When you are prompted for a password, type
A second command prompt window appears.
- After you apply the patch, type exitin the second command prompt window, and then press ENTER.
- If you previously configured custom access control settings or database account permissions for the ASPNET account, you must now reapply these settings.
REM Start Batch File
REM This batch file addresses issues that exist with the MS03-32
REM Security Update when you run ASP.NET 1.0 on Windows XP.
REM If you have any other configuration, do not run this file.
if exist %SystemRoot%\microsoft.net\framework\v1.1* goto v11_installed
REM Change to the .NET Framework installation directory.
cd /d %SystemRoot%\microsoft.net\framework\v1.0.3705
echo "Stopping IIS."
echo "Stopping the ASP.NET state service if it is running."
net stop aspnet_state
echo "Deleting the ASPNET account."
net user ASPNET /delete
echo "Creating a new ASPNET account with a temporary password."
net user ASPNET 1pass@word /add
echo "Launching runas to create a profile."
echo "You see a command window being created."
echo "Type 1pass@word when you are prompted for the temporary password."
runas /profile /user:ASPNET cmd.exe
echo "Reregistering ASP.NET and the ASPNET account."
echo "A new random password has been autocreated for the ASPNET account."
echo "Restarting IIS."
echo "The workaround has been applied."
echo "Try to access an ASP.NET page."
echo "If you have any custom access controls settings for the ASPNET account,"
echo "you must re-create them."
echo "If you were running the ASP.NET state service, you must restart it."
echo "Version 1.1 appears to be installed. Do not run this file."
REM End of batch file.