HTTP error 401.1 when accessing Content Server

[Isabel Mari Berg]

Hi

I have a customer trying to access his content server using http. He gets the error message 401.1 access denied, before being able to enter login credentials.

Have any of you experienced similar problems?

[mahkrish]

Hi Isabel, This could be due to below cause.

Cause:

1. The “tcs” virtual directory in IIS may have an invalid anonymous username and
   password. This is most likely to happen if the Content Server’s media has been moved
   to or from a NAS with the NAS wizard and an invalid username and password was
   specified during the wizard.
2. The usernames or passwords for the IUSR_ and
   IWAM_ accounts may have been manually changed in Local Users
   and Groups but not the IIS metabase or vice versa.

Try the below steps:

Solution 1

To set the anonymous username and password for the “tcs” virtual directory to the
default (if the Content Server’s media is not located on a NAS):

a. To obtain the password in clear text, you must modify adsutil.vbs so that it
displays the unmasked password. To do this, follow these steps:
i. Open C:\Inetpub\AdminScripts\adsutil.vbs in notepad.
ii. On the Edit menu, click Find, type IsSecureProperty = True, and then
click Find Next.
iii. Change "IsSecureProperty = True" to "IsSecureProperty = False".
iv. Save the changes to adsutil.vbs. Leave the file open so that you can
restore it when finished.
b. At a command prompt, navigate to the C:\Inetpub\AdminScripts directory:
cd C:\Inetpub\AdminScripts
c. To get the anonymous username (it should be IUSR_TANDBERG-CS), type
the following at the command prompt:

cscript.exe adsutil.vbs get w3svc/AnonymousUserName
d. To get the password, type the following at the command prompt:
cscript.exe adsutil.vbs get w3svc/AnonymousUserPass
e. To set the anonymous username, type the following at the command prompt:
cscript.exe adsutil.vbs set w3svc/1/Root/tcs/AnonymousUserName
””
f. To set the password, type the following at the command prompt:
cscript.exe adsutil.vbs set w3svc/1/Root/tcs/AnonymousUserPass
””
g. To ensure that the necessary directories have the correct permissions with this
anonymous username account, run a Repair with the TCS installer.
h. Restore Adsutil.vbs by changing the line back to “IsSecureProperty = True”.

To set the anonymous username to another account (if the Content Server’s media is
located on a NAS then the anonymous username must be a domain account):

a. Go to Computer Management and expand Services and Applications > Internet
Information Services (IIS) Manager > Web Sites > Default Web Site.
b. Right click on “tcs” and select Properties.

c. Select the “Directory Security” tab and click on the Edit button under
“Authentication and access control”.

d. Enter the username and password and select OK. Re-enter the password to
exit the “Authentication Methods” dialog and select OK to exit the “tcs
Properties” dialog.
e. To ensure that the necessary directories have the correct permissions with this
anonymous username account, run a Repair with the TCS v2 installer. See
section 4.1 “Correcting problems by running a Repair with the TCS v2
installer”.
f. If the media is located on a NAS, then the account specified in step d needs
read, write and change permissions on the “data” directory in
location>.

Solution 2:

To synchronise the passwords for the IUSR and IWAM accounts in the Internet
Information Server (IIS) metabase and Local Users and Groups:

a. Go to Computer Management, expand “System Tools”, then “Local Users and
Groups” and right click on IUSR_ from Users and select “Set
Password”.
b. Set the password to a new, secure password.
c. Right click on IWAM_ from Users and select “Set Password”.
d. Set the password to a new, secure password that is different from the one in
step b.
e. At a command prompt, navigate to the C:\Inetpub\AdminScripts directory:
cd C:\Inetpub\AdminScripts
f. To set the IUSR username, type the following at the command prompt:
cscript.exe adsutil.vbs set w3svc/AnonymousUserName
IUSR_
g. To set the IUSR password, type the following at the command prompt:
cscript.exe adsutil.vbs set w3svc/AnonymousUserPass ””
h. To set the IWAM username, type the following at the command prompt:
cscript.exe adsutil.vbs set w3svc/WAMUserName IWAM_
i. To set the IWAM password, type the following at the command prompt:
cscript.exe adsutil.vbs set w3svc/WAMUserPass ””
j. To ensure that the necessary directories have the correct permissions with this
anonymous username account, run a Repair with the TCS installer.

HTH.

BR, Mahesh Adithiyha

[Magnus Ohm]

Hi Isabel

Since they where suddely unable to login what changed before this? Did they change the authentication on the TCS to domain / ldap login without adding a valid user with admin rights before logging out?

Or was the tcs added to the domain and some group policies applied?

The rescue URL is http://tcsip/tcs/#page:login&rescue:true

/Magnus

Sent from Cisco Technical Support iPhone App

[Isabel Mari Berg]

Hi

Thanks to both of you. I’ve tried Mr. Mahesh Adithiyha suggestion no. 1. But it didn’t help.

I’ve also tried the rescue page Magnus referred to but the error is still “You are not authorized to view this page”.

I’m attaching the error message and the error log after doing the repair option from the install.exe.

I'll be more then grateful for any suggestions

Isabel

[Isabel Mari Berg · Accepted solution]

After a boot of the TCS (never underestimate a boot) the web page is accessible. Thanks for all your help!

[mahkrish]

Hi Isabel, Thank you for sharing the feedback on the steps. Glad to hear restart of the TCS server helped to resolve the portal access.

BR, Mahesh Adithiyha

[Patrick Sparkman]

Yeah, you should always do a reboot, it's part of the unmentioned steps that must be taken after a repair.  Find myself thinking often, "Okay I ran the repair, but it's still not working.  Oh wait, I forgot to reboot - minutes later after reboot, it's working!".