Server: Microsoft-IIS/7.0\r\n : IIS FAQs

Warning: Authorization - Cannot verify access to path (C:\inetpub\wwwroot\).

qbernard — Wed, 04 Nov 2009 09:51:00 GMT

I'm sure you have seen the below warning message many times with IIS 7+ The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built...(read more)

WebDav Encoding Vulnerability - Fixed

qbernard — Wed, 10 Jun 2009 05:32:00 GMT

Today, Microsoft released patch update for IIS 5.0/5.1/6.0 WebDav encoding issues with "/" character discovered last month , you can get the hotfix here ....(read more)

Security Alert - Vulnerability in Internet Information Services Could Allow Elevation of Privilege

qbernard — Tue, 19 May 2009 23:04:00 GMT

Two days ago, a new vulnerability was found in WebDav for IIS, although few have make a big deal out of it, personally I think the impact is 'quite' minimum or at least zero in my environment coz I got no WebDav at all :) LOL... anyway - here...(read more)

IIS FTP and IE 7 (No user folder redirection)

qbernard — Mon, 08 Oct 2007 05:21:00 GMT

Remember about this blog I posted last year... and many users still complaining about the new IE 7 behavior changes when connecting to IIS FTP.
It is confirmed now - as per this latest KB, this is new design changed in IE 7 :) and you are recommended to use Windows Explorer instead as per Microsoft's suggestion. Mm.. lucky I'm not much of an IE 7 fans for FTP, for you guys that hated this change, I suggest your head over to IE team blog and bang them again :)

Website Property page mapping between IIS 6 and IIS 7.

qbernard — Sun, 12 Aug 2007 05:36:00 GMT

Ever wonder where to configure HTTP KEEP-ALIVE in IIS 7.0, or where to configure detail error message to be sent from ASP scripting engine. When I started to learn about the new IIS 7.0 IIS Manager, I always get frustrated coz it is quite different from the normal 'right mouse - property' configuration theme in IIS 6. But now, after I get used to the new interface, when I go back to my IIS 6 box, I got lost again :)

So how much different in term of IIS UI between the two versions? I took a few minutes to do a quick mapping from IIS 6 website property page to the new IIS 7.0 IIS Manager:

Task	IIS 6.0	IIS 7.0
IP Bindings and port	Web site – Properties – Web site tab	Actions pane - Bindings
Connection timeout	Web site – Properties – Web site tab	Actions pane - Limits
HTTP Keep-Alive	Web site – Properties – Web site tab	Features View pane – HTTP Response Header – Set Common Headers
Logging	Web site – Properties – Web site tab	Features View pane – Logging
Bandwidth Throttling and Connection limits	Web site – Properties – Performance tab	Actions pane - Limits
ISAPI Filters	Web site – Properties – ISAPI Filters tab	Features View pane – ISAPI Filters
Home Directory	Web site – Properties – Home Directory tab	Actions pane – Basic Settings / Advanced Settings
UNC Resource	Web site – Properties – Home Directory tab	Actions pane – Basic Settings / Advanced Settings
Redirection	Web site – Properties – Home Directory tab	Features View pane – HTTP Redirect
IIS Permissions – Scripts source access, Read, Write, Directory Browsing, Log Visits, Index this resource	Web site – Properties – Home Directory tab	Scripts source access: Feature depreciated.
		Read, Write: NTFS permissions and Features View pane – Authorization Rules
		Directory Browsing: Features View pane – Directory Browsing
		Log Visits: Features View pane - Logging
Application Name	Web site – Properties – Home Directory tab	Features View pane – View Applications
Execute Permissions (None, Scripts Only, Scripts and Executable)	Web site – Properties – Home Directory tab	Features View pane – Handler Mappings – Edit Handler Permissions
Application Pool	Web site – Properties – Home Directory tab	Actions pane – Basic Settings / Advanced Settings
Application Extensions Mapping	Web site – Properties – Home Directory tab – Configuration – Mapping tab	Features View pane – Handler Mappings
ASP Configuration (session timeout, buffering, parent paths)	Web site – Properties – Home Directory tab – Configuration – Options tab	Session timeout: Features View pane – ASP – Sessions Properties
		Buffering and Parent Paths: Features View pane – ASP - Behavior
ASP Debugging Flags (server-side and client side debugging, error message handling.	Web site – Properties – Home Directory tab – Configuration – Debugging tab	Features View pane – ASP – Debugging Properties
Default documents	Web site – Properties – Documents tab	Features View pane – Default Document
Document footer	Web site – Properties – Documents tab	Feature depreciated from UI. Configure via AppCmd.exe instead. For example - appcmd set config “Fabrikam HR” /sections:staticContent /enableDocFooter:true /defaultDocFooter:”d:\foot.html” /isDocFooterFileName:true to configure document footer.
Authentication	Web site – Properties – Directory Security tab	Features View pane – Authentication
IP address and domain name restriction	Web site – Properties – Directory Security tab	Features View pane – IPv4 Address and Domain Restrictions
Secure Communication (SSL)	Web site – Properties – Directory Security tab	Features View pane – SSL Settings
HTTP Headers (content expiration, HTTP Headers, content rating, MIME Types	Web site – Properties – HTTP Headers tab	Content expiration and HTTP Headers: Features View pane – HTTP Response Headers
		Content Rating: Feature depreciated from UI, However, you can try to configure the P3P policy via AppCmd.exe
		MIME Types: Features View pane – MIME Types
Custom Errors	Web site – Properties – Custom Errors tab	Features View pane – Error Pages

Bug: Application Creation via AppCmd.exe

qbernard — Sun, 15 Jul 2007 12:32:00 GMT

I was trying to find the syntax in AppCmd.exe to convert an existing virtual directory say - myVdir to be an application.
Obviously, the first step is to create the virtual directory. (I know I can do both with appcmd add app bla bla and create the associated vdir). but I was looking for the way to do it as the IIS Manager, right mouse - Convert to Application)

Step 1 - create the vdir
appcmd add vdir /app.name:"default web site/" /path:/myVdir /physicalPath:c:\temp\vdir
Output:
VDIR Object "default web site/myVdir" added

Then, I spent sometime looking on how to 'covert' myVdir to an application itself, in other words make the <virtualDirectory> itself as "/" or root vdir which indicates that it is an application staring point in IIS 7.0. But I got no luck :( maybe my mind got stuck after playing with AppCmd.exe for 3hrs. I can't use "appcmd set vdir" as there's no options for application, and I can't apply "appcmd set app" because it is not an application yet, it is just a Vdir using the root application.

Anyway, so after awhile I decided to use "appcmd add app" and hoping that IIS detects that the vdir already defined, and it will just reconfigure it as an application. So,
Step 2 - create the app
appcmd add app /site.name:"default web site" /path:/myVdir /physicalpath:c:\temp\vdir
Output:
APP Object "default web site/myVdir" added
VDIR Object "default web site/myVdir/" added

Voila!!! I was so happy, I thought it works as I was expecting duplicate element error :) but no error msgs. So I fired up IIS Manager to check! Zzz... I can't no longer expand the "default web site", and got an error msgs saying "An item with the same key has already been added". Sigh! so the configuration store accepted the duplicate entry and now it complaints! Argghhh!!!

Now, to fix this! again I found something interest. You can do it via UI in Vista, but not W2k8 Beta 3. For vista, just click OK to ignore the error, then View Applications - right click on myVdir, and then click Remove. Now, if you try the same steps in W2k8, after the delete confirmation dialog box, you got back the "An item bla bla ........." error msgs again :) To fix this for W2k8, go to applicationHost.config file and manually remove the duplicate entry. And I conclude this as a validation bug of appcmd when trying to manipulate the configuration store.

Mm....now! I'm back at where I started. so is it possible to 'Convert to Application' for existing vdir via AppCmd.exe ???

Updated - 170707
I should have mentioned that W2k8 I'm using is from April CTP, you won't get the UI error in June CTP.
Also, according to Microsoft - it is acceptable to have same /alias inside the different application. In my case, the vdir of the default web site/ root application will never get reference as the /myVdir application's vdir definition kicks in first. Mm.... I still don't like the idea, why it accept both when only 1 is technically working?

Anyway, for my question - no way to 'covert to application' from appcmd.exe in 1 step :)
You can however, first delete the vdir, then create the app..... two steps at least.

How to configure HTTP KEEP-ALIVE in IIS 7 ?

qbernard — Tue, 10 Jul 2007 06:26:00 GMT

Oh man, it actually took me 30mins to figure out where to configure this in IIS 7.0. Again, you will take sometimes for you to get familiar with the new IIS Manager UI in IIS 7 :)

Now HTTP Keep-Alive is inside http spec to maintain open connections between client browser and web server, this can improve the overall performance rather than initiating new connection for new request, at the same time, keep-alive is needed for Windows authentication, etc.

In IIS 6, this setting is pretty expose :) or at least easy to find as it is in web site tab everytime you look at the web site property. For IIS 7.0, you need to go to HTTP Response Header icon in Feature View pane, then click on Set Common Headers at the Action task pane. Take note that the UI interface only available for Windows 2008, this is one of the missing UI in Vista, hopefully this will fix in Vista SP1. By default, keep-alive is enabled.

For Vista, you can set it via AppCmd.exe. E.g. disabling keep-alive.
appcmd set config /section:httpProtocol /allowKeepAlive:false

Sigh, I only found out about this article via google while I was searching for keep-alive element name in the configuration file, should have google it before I even start to looking for it in the UI :)

How to configure Scripts Only or Scripts and Executable in IIS 7?

qbernard — Tue, 10 Jul 2007 05:01:00 GMT

In previous versions of IIS, you can always specify IIS application execute permissions to None (read), Scripts only (scripting engine, and Scripts and Executable (executable dll, exe, etc files). This can be set at each of the site, directory, virtual directory level via the home or directory tab of the site property.
The value of the settings is kept using AccessFlags metabase key, this has changed in IIS 7.0, the metabase key is depreciated.

While I was playing with it, I came across a blog post by Thomas, application execute permissions settings now are set using Handler Mapping icon in IIS 7.0 Manager, Thomas promised to add in the UI picture, obviously he must have been too busy or forgotten about this. Anyway, this is UI when you click on the 'Edit Handler Permissions' link.

It is also important to take note that the new accessPolicy will be the configuration element inside <handlers> collection to control all request handler mappings. The settings can be configure at site (applicationHost.config), or web.config file located for the directory you configured.

Why you need Vista Business / Ultimate for IIS 7?

qbernard — Tue, 03 Apr 2007 07:41:00 GMT

I talked about Vista SKUs and IIS 7 before :) yet it wasn't that clear as of why you might want to pick up Vista Business or Ultimate to experience the full IIS 7. Yes, we do have IIS 7 features matrix over at IIS.net, yet I think that's a bit messy :p and hard to read.

Why you should get Business or Ultimate editions? simply because these are the only 2 SKUs that give you complete IIS feature sets. To verify against the matrix published on IIS.net, I fired up my VMware Server and install all SKUs - starter,home basic, home premium, business on my Vista Ultimate x64 :) each of the installations took about 30mins or so, then I look at the each of the 'Turn Windows on or off' program list, here's what I got:

				Starter / Basic	Premium	Business / Ultimate
Internet Information Services
	FTP Publishing Services
		FTP Management Console				Y
		FTP Server				Y

	Web Management Tools
		IIS 6 Management Compatibility
			IIS 6 Management Console		Y	Y
			IIS 6 Scripting Tools		Y	Y
			IIS 6 WMI Compatibility		Y	Y
			IIS Metabase and IIS 6 configuration compatibility	Y	Y	Y
		IIS Management Console			Y	Y
		IIS Management Scripts and Tools		Y	Y	Y
		IIS Management Services			Y	Y

	World Wide Web Services
		Application Development Features
			.Net Extensibility	Y	Y	Y
			ASP		Y	Y
			ASP.NET		Y	Y
			CGI		Y	Y
			ISAPI Extensions		Y	Y
			ISAPI Filters		Y	Y
			Server-Side Includes		Y	Y
		Common Http Features
			Default Document		Y	Y
			Directory Browsing		Y	Y
			HTTP Errors	Y	Y	Y
			HTTP Redirection	Y	Y	Y
			Static Content		Y	Y

	Health and Diagnostics
		Custom Logging			Y	Y
		HTTP Logging		Y	Y	Y
		Logging Tools		Y	Y	Y
		ODBC Logging				Y
		Request Monitor		Y	Y	Y
		Tracing		Y	Y	Y

	Performance Features
		HTTP Compression Dynamic		Y	Y	Y
		Static Content Compression			Y	Y

	Security
		Basic Authentication			Y	Y
		Client Certificate Mapping Authentication				Y
		Digest Authentication				Y
		IIS Client Certificate Mapping Authentication				Y
		IP Security		Y	Y	Y
		Request Filtering		Y	Y	Y
		URL Authorization		Y	Y	Y
		Windows Authentication				Y

Red - Exclusively for Vista Business and Ultimate
Yellow - Default features included in all SKUs

So it is pretty clear that Starter and Home Basic are indeed very limited, you don't even get Static Content module with it :) You basically need to extend the web core at your own effort. It has only 13 modules shipped with the OS. Next - Home Premium, few modules are missing such as FTP and advanced authentication schemes like Digest and Windows. I know Business and Ultimate are more $$$ than the lower SKUs, but if you really plan to develop on IIS7, you should pick up either Business or Ultimate edition.

Next, talk about FTP - not sure if this is still NDA :) but heck! you guys will love this. There will be an out-of-band FTP component on IIS.net which will replaced the old IIS 6 FTP that you get with today's Vista. Completely rewrite with FTPS support, enhanced ftp user isolation, ftp site host name support and lot more.

Vista - IIS 7 - The Missing UI

qbernard — Sat, 20 Jan 2007 05:01:00 GMT

No doubt IIS 7 is the next evolution of Microsoft webserver, it will soon rewrites the history of Internet webserver, and not sure how this chart will look in recent future :) As of today, to experience IIS 7, you can of course get Vista for client OS, or the complete set of IIS 7 with Longhorn (beta2). Now, been playing for Vista Ultimate RTM for months, top of the line Dell desktop - yet somehow not really stable and slow. Unstable could be the drivers for various hardware, slowness ? have not got single clue. It boots slower than my laptop XP, and it has score of 5.3 in term of Windows Experience Index, FYI 6.0 is the current full score! plan to rebuild the box... will do that after the major release to general public.

Anyway, what's the deal about missing pieces of UI in Vista II7? Well, not sure the reason behind, timeline / change freezed would be the reason why you are not seeing certain UI in Vista. So far, I have noticed few:

a) Http Redirect - where you redirect browser request. so how to deal with this? Jon has the answer.

b) Logging UI - UI to configure various logging options, etc. I found this one pretty annonying :) especially, if you are like me! I'm clueless about asp.net configuration, with the tight integration between asp.net and IIS 7. You need to understand how does the configuration system works. E.g. like config section, inheritance, locking, etc. I spent few hours trying to figure out to do this via appcmd.exe and in between that killed my IIS 7 :( Anyway, Steve has got some pretty good info for this.

Update: 01/02/2007 Tobin just released the Logging UI add-on @ IIS.Net Download Center!

c) IP Restriction - configuration for IP address or domain name restriction, something that we don't see this in client OS version. but according to this featuresets matrix, the IpRestrictionModule is included. The funny part is if you try the directory security tab for IIS FTP (managed via the IIS 6 MMC), the restriction option is not enabled - same deal as previous client OS where the IP restriction feature is only available for server OS. Since my IIS 7 is gone, I can't try to configure this via appcmd.exe

d) Certification Mapping - ha! actually came across this from Ulad today, this is where you configure client certificate authentication.. Ulad developed a script to configure one-to-one cert mapping. To be honest, out of many years of using IIS, I have yet to work on one project that required client cert.

That's it. I believe there's more missing UI or didn't make it to Vista IIS 7. Not sure if Microsoft going to fix this, but I do hope somehow somewhere, an update package will come out soon.

Update: Microsoft is going to address this in Vista SP1 timeframe. Special thanks to Bill Staples for the information.

How to prevent IIS FTP from attacks?

qbernard — Thu, 11 Jan 2007 08:16:00 GMT

From time to time, many users asked about how to configure IIS FTP to prevent brute force or dictionary attacks. The answer is NO, IIS FTP does not help you prevent this natively. If there's only few known attack IP addresses (check iis ftp log file), you can manually block those IP address via the IP Address / Domain Name restriction setting. Now, what if you need a smart way to detect the attack and automatically block those IP addresses ? Well, I have came across the following scripts that will be able to help you, try:
a) http://blog.netnerds.net/2006/07/ban-administrator-ftp-login-attemps/
b) http://www.codeproject.com/useritems/FTPSecurity.asp

c) Updated link - http://www2.irobx.net:8010/serendipity/index.php?/archives/1-FTP-autoban-script-for-IIS.html
d) http://blog.netnerds.net/2006/07/iis-instantly-ban-ips-attempting-to-login-to-ms-ftp-as-administrator/

Note: I have not tested any of it :) why? it is not because I don't get attack, it's because the environment I running now is within VPN connection + there's smart IDS which help prevent the attack from internal. Next, you may also want to take note that eventually when you may end up with thousand of IP addresses in the restriction list, sometime it will be quite hard for you to manage it, say maybe you need to remove one or few of the IP addresses, and also each time a new connection to the IIS FTP, IIS will scan through the list before deciding whether or not the connection is 'acceptable', hence there's overhead and consume certain server resources, that's why I felt the best way to block the attack is always at the router/firewall level. make sense ?

What's Changed - IIS 7 Status Codes

qbernard — Tue, 19 Dec 2006 01:33:00 GMT

Besides the standard IIS Status code you can find in this KB. You will find the follow new status codes been introduce with IIS 7.

New -
404.4 - File or directory not found: No module handler is registered to handle the request.
404.5 - URL sequence denied. The specified URL sequence is not accepted by the server.
404.6 - HTTP verb denied. The specified HTTP verb is not accepted by the server.
404.7 - File extension denied. The specified file extension of the resource is not accepted by the server.
404.8 - URL namespace hidden. The namespace of the specified URL is hidden by configuration.
404.9 - File attribute hidden. The requested file has a hidden attribute which prevents it from being served.
404.10 - Request header too long. One of the request headers is longer than the specified limit configured in the server.
404.11 - URL is double-escaped. This URL is denied because it is susceptible to double-escaping attacks.
404.12 - URL has high bit characters. This URL is denied because it has high-bit characters.
404.13 - Content-Length too large. This URL is denied because the Content-Length set is longer than specified by configuration.
404.14 - URL too long. This URL is denied because its length is longer than specified by configuration.
404.15 - Query-String too long. This URL is denied because its Query-String is longer than specified by configuration.
As you may noticed, lot of new 404 entries. 404.13/.14 replaced the 413/414 status codes and re-category under 404.

500.14 - Server error: Invalid application configuration on the server.
500.17 - Server error: URL authorization store cannot be found.
500.19 - Server error: Data for this file is configured improperly in the configuration store.

Removed -
403.20 - Passport logon failed. This error code is specific to IIS 6.0.
As Passport Login support has been removed from IIS 7.0

Duplicate -
405 - HTTP verb used to access this page is not allowed.
Not sure what's the difference with 404.6 :)

Unknown -
401.6 - Unauthorized: URL authorization scope was not found on the server.
401.7 – Access denied by URL authorization policy on the Web server. This error code is specific to IIS 6.0
407 - Proxy authentication required.
410 - File has been removed.
415 – Unsupported media type.
500.11 - Server shutting down
500.12 - Application is busy restarting on the Web server
Not sure if these still supported...

Let me know if you found any new status code...

IE7 and IIS FTP

qbernard — Wed, 15 Nov 2006 03:24:00 GMT

I'm sure IE7 is great :) but if you have been playing with IE7 with IIS FTP, both don't click well together. If you have standard redirection folder structure configured in IIS FTP. E.g. username = ali and one of the folder name is ali. The user will get auto redirected to the 'ali' folder, when user 'ali' sign in. But this is not working with IE 7, you are not redirected to home folder but remain at ftp root folder.

This is not any IIS FTP setting you can tweak. It is purely client side application issue. Not sure if IE team going to fix this. But feel free to bug them here :)

Patching issue with MS06-034 - ASP Vulnerability

qbernard — Wed, 19 Jul 2006 06:20:00 GMT

If you are having issue while apply MS06-034 patch (e.g. repeated AU update offers) , refer this KB for workaround solution. In short, you need to add/remove 'Common Files' IIS component in the Add/Remove Windows Components applet. For W2k3SP1, just resinstall the update package again. (packaged has been updated by MS)

Appcmd.exe - the next generation of IIS command line tool

qbernard — Tue, 06 Jun 2006 03:11:00 GMT

What's going to happen to iisapp.vbs, iisftp.vbs, iisbackup, iiscnfg.vbs, adsutil.vbs in IIS 7? Gone! all will be gone and replaced by Appcmd.exe! Formerly known as IIScmd.exe. This new command line tool will be your favourite IIS command line in IIS 7. So what's so cool about it ? Read the overview here @ iis.net. And Sukesh shows you how to use the tool to create 1000 websites on the fly.... :)

Vista SKUs and IIS 7.0

qbernard — Fri, 02 Jun 2006 02:25:00 GMT

Do you get IIS 7.0 with Vista Home edition? Well, yes and no - Yes for Home Premium and No for Home Basic edition :) So which editions of Vista comes with IIS 7.0 ? Microsoft plans to release 5 SKUs for Vista, and IIS is included with

Vista Starter	No
Vista Home Basic	Yes (very limited)
Vista Home Premium	Yes (limited)
Vista Business	Yes
Vista Enterprise	Yes
Vista Ultimate	Yes

Starter edition is not really a SKU as it is just striped down version of Home edition which has been customized and localized. Next, the good news for Vista IIS is that it no longer has the 10 concurrent connections limit that you see with XP Pro. Horrayyyyyy! and you have the ability to host more that 1 website with Vista IIS! developers will love this! yeahhhhh! no more virtual directory hassle for separate application. So no more limitation? Vista IIS will be the same as the full blown version with Longhorn IIS? Well, you wish :) I think the standard limitations such as IP restriction, odbc logging (??), etc still applied. While there is no more connections and websites limit, you will now get a new request processing limit, meaning at one time the IIS is capable to process X number of requests at any one time, and subsequence incoming requests will be hold in the process queue. This is not too bad deal consider with the removal of other limitations.

Oh ya, what is IIS (limited) for Vista Home Premium? Well, it has the full features set of Vista IIS, except FTP services component. What else is missing? Errr..... NNTP is gone :( frontpage is gone :) SMTP? should be there but don't expect any fancy improvement. what else? mm.... time to go now, let you know when I have more info about IIS 7.0

Updated 7/06/06 - Thomas Deml - Lead PM has posted more information about the request limit of Vista IIS. Home editions can serve up to 3 requests concurrently :( and take note of the very limited IIS of Home Basic edition as well.

IIS 7 Podcast

qbernard — Fri, 02 Jun 2006 02:18:00 GMT

From the ASPNET Podcast team - Wally gives you the IIS 7 podcast with Chris Adam, Thomas Deml and Brett Hill. Download it here.

IIS Insider - May 06

qbernard — Sun, 14 May 2006 10:20:00 GMT

It's me again - this month :) Click here ! The archive URL will be up next month.
Let me know if you need more information.

'ASP 0201' Invalid Default Script Language

qbernard — Mon, 03 Apr 2006 05:28:00 GMT

This is a pretty common ASP error that could due to number of reasons; before we go into various ways to fix this error, let’s take a look at the error itself. So what’s the complete error message? Well, I got the following when simulating one of the possible cause of this. Typically, you will see this:

Active Server Pages error 'ASP 0201'
Invalid Default Script Language
The default script language specified for this application is invalid.

Or similar error message as highlighted in this KB - ASP0201: Invalid Default Script Language. As indicated in the article, the error is caused by non-supported scripting languages that IIS is unable to recognize. Now how to fix this? Try the following:

1) Make sure proper scripting language is defined in IIS. As per the above article, make sure the Default ASP Language is set to VBScript (by default), or JScript if you preferred Java Scripting.
2) Take note that your code will override the first setup if you have <% Language=”language” %> defined at the beginning of your script. So, double checks to ensure you don’t have spelling or typo error. It should be <% Language=”VBScript” %>
3) From time to time, this may due to incomplete DLL registration for those scripting engine and to get the scripting engine up to date, please get the latest scripting engine here. At the time of this writing, the latest version is 5.6.
4) Now, I have seen issue when installing the Scripting engine, e.g. unable to register certain DLLs, etc. What you can try next is to register the following DLLs:
regsvr32 %windir%\system32\VBscript.dll
regsvr32 %windir%\system32\JScript.dll
regsvr32 %windir%\system32\Inetsrv\Asp.dll
5) Moving on, if you reach this step, it is likely due to permission issue. E.g. iusr_computername account for anonymous access does not has READ permission over the related DLLs, you then try grant NTFS read permission to the DLLs in step 4 for your request account.
6) Next, following step 5 – if you still facing the same problem, you could take another step to ensure that all relevant permissions are in place, refer the following KBs:
IIS 4 - Required NTFS permissions and user rights for IIS 4.0
IIS 5 - How to set required NTFS permissions and user rights for an IIS 5.0 Web server
IIS 6 - Default permissions and user rights for IIS 6.0
7) Typically, if you have followed all the previous steps you should no longer see the same error message. Just in case, you missed some of the configurations in earlier steps, you can then temporary make the iusr_computername or your defined request user account to the local administrators group. Take note, this is just for troubleshooting purpose! You should NOT grant the default anonymous account with local administrative rights, and make sure after the troubleshooting you remove the account for the administrators group.

The idea behind this is to check if adding the user to this administrators group fixes the error, if yes, it is confirmed that there are yet permission issues that not being addressed or overlooked in previous steps. After removing the account from the administrators group, you can then get Filemon and Regmon from sysinternals.com to trace the permission issue.

.Net 2.0 - The XML page cannot be displayed.

qbernard — Thu, 30 Mar 2006 06:42:00 GMT

Symptom:
You are getting the following error message:

The XML page cannot be displayed

Cannot view XML input using XSL style sheet. Please correct the error and then click the Refresh button, or try again later.

A name was started with an invalid character. Error processing resource 'http://localhost/xxx.aspx. Line 1, ...

<%@ Page Language="VB" ..... Title="Home Page" %>

Description:
This is mostly due to incomplete registration of the new .NET framework installation. but why such an irrelevant error message? Errr... don't ask :p

Resolution:
a) Re-register the .NET framework, similar to this KB.
306005 How to repair IIS mapping after you remove and reinstall IIS
Just ensure you are in the correct 'version' folder...then execute the following command.
"%windir%\Microsoft.NET\Framework\version\aspnet_regiis.exe" -i

b) There are few instances that Step a) may not complete solve the problem. Hence, what you can try next is to reinstall the .NET Framework package via Control Panel - Add or Remove Programs.