Permission Denied problem (CreateObject)
Pieter Vandenheede
I have this VERY strange problem on one of our Windows 2000 Adv.
Server machines and I hope someone may be able to help me.
I have created a dll 'Dll' with several components. I need
this Dll to be included in COM+, because I'm working with COM+
transactions (there is no other way, because I'm using transactions
over MSMQ and DB).
The strange thing is that I am not able to successfully create an
instance of ANY component of that DLL...
I have a ASP (VBScript) site running under the IUSR_[COMPNAME] user in
an Isolated IIS process (High). This site obviously needs to create an
instance of one of these components 'Dll.Comp'. Whenever I try to
create an instance I get the "Permission denied 'CreateObject'" error.
So I thought I'd experiment with a small VBS to see what was wrong:
Dim o
Set o = CreateObject("Dll.Comp")
MsgBox TypeName(o)
Set o = Nothing
I get the same error...
Now the strange thing is this:
My Dll runs in a COM+ Application which runs under the account
'MTSUser'. MTSUser is a member of the group 'Administrators'.
The permission on my Dll on the file-system are as follows:
Administrators FC
IUSR_[COMPNAME] RE
IWAM_[COMPNAME] RE
MtsUser FC
SYSTEM FC
But when I check with FileMon I get the following line (12 times):
Request: OPEN
Path: Path to my Dll
Result: ACCESS DENIED
Other: [COMPNAME]\MtsUser
I also checked with RegMon, but it doesn't say anything interesting
except that everything seems pretty OK.
I have done several things to avoid this, but none of the following
seem to work :S
(1) Run the DLL under another username which is member of the
Administrators group
(2) Reset all permissions on Dll folder and file
(3) Recreate Dll folder and file
(4) Recreate COM+ Application
(5) Re-insert COM+ Dll and its components
(6) Re-compile
It does work when I let the COM+ application run under the user where
I logged in with. It also works when I delete the components in COM+
and just run a regsvr32 on it... even when I do that under the
'MTSUser' :S
Maybe worth mentioning: I can't login physically on these servers,
only through the use of Terminal Services.
I have tried EVERYTHING that I know of and that seems the slightest
bit logical, but no effect yet.
What's even more strange is that this problem occured on a similar
server also (when I introduced this version of the Dll) but when I
checked and changed some things the problem disappeared suddenly (too
bad: I have no clue why).
Now this might seem worth mentioning:
The problem started when I referenced the 'COM+ Services Type Library'
in Visual Basic. Now a normal person would say: take away the
reference again and check then, but I've already tried that and the
problem remains.
Maybe worth mentioning also: The 2 servers are load balanced by use of
software load balancing through the use of MS Windows Adv. Server.
I have already looked for solutions and I have found a tool
'dcomcnfg'.
The permissions on both of the servers (one working, one not) are the
same.
I don't know what 'dcomcnfg' does actually, so if some-one would be
able to give me some more in-depth info about that I'd be thankful and
it might help solving this thing...
Anyway: If someone might be able to give any (much needed)
help/info/suggestions I'd be happy to massage their feet ;)
Thanks for reading this in the first place :)
Kind Regards
Pieter Vandenheede
Software Engineer