Troubleshooting the sensor

This topic describes common problems that occur with the Microsoft IIS Web server sensor and presents solutions for those problems.

IIS module dependencies are not included in business applications

Problem
Even when IIS module dependencies are created, they are not included in business applications.
Solution
The IIS module dependencies are not included in business applications because the default grouping pattern configuration excludes such relations. To solve the issue, complete the following steps:
  1. Export the default configuration by running the bizappscli tool:
    $COLLATION_HOME/sdk/bin/bizappscli.sh exportDefaultConfiguration -f conf.xml
  2. Open the conf.xml file and remove the following lines:
    <exclude relation="{any}" source="app.web.iis.IIsModule" target="{any}"/>
<exclude relation="{any}" source="{any}" target="app.web.iis.IIsModule"/>
  3. Import the modified configuration by running the bizappscli tool:
    $COLLATION_HOME/sdk/bin/bizappscli.sh importDefaultConfiguration -f conf.xml

No Web server information discovered

Problem
The sensor does not discover any Web server information.
Solution
If the Web server information is missing, check the logs to determine if the tool program AdsiDump and AdsiEnum commands succeeded or failed.
Check whether the tool program QueryRegistry commands succeeded. Two registry paths are queried.
  • HKLM\SOFTWARE\Microsoft\W3SVC
  • HKLM\SYSTEM\CurrentControlSet\Services\W3SVC

    The first key provides general software information for IIS and the second provides service-related information.

System fails with an unknown error (0x80005000)

Problem
While discovering IIS8 on the Windows Server 2012 with User Account Control turned on, the following error occurs:
System.Runtime.InteropServices.COMException (0x80005000): Unknown error (0x80005000)
Solution
To fix the problem, complete the following steps:
  1. On the target machine, run the Registry Editor, Regedit.exe.
  2. Set the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System LocalAccountTokenFilterPolicy value to 1.
  3. In the Control Panel window, click the Administrative Tools tab and open Local Security Policy.
  4. Expand Local Policies and click Security Options.
  5. Change the following policies:
    • Set the Behavior of the elevation prompt for administrators in Admin Approval Mode policy to Elevate without Prompting.
    • Set the User Account Control: Detect application installations and prompt for elevation policy to Disabled.
In order to configure policies on the system with Active Directory, complete the following steps:
  1. In the Control Panel window, click the Administrative Tools tab and open Group Policy Management.
  2. Choose forest and domain and select Default Domain Policy.
  3. Click Action > Edit.
  4. Open Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Security options.
  5. Change the following policies:
    • Set the Behavior of the elevation prompt for administrators in Admin Approval Mode policy to Elevate without Prompting.
    • Set the User Account Control: Detect application installations and prompt for elevation policy to Disabled.