At one of my customers, we are still (happily) using Microsoft Web Deploy to deploy our web applications to IIS. This works great and is all nicely automated and integrated in our Azure DevOps pipelines. Until the moment it no longer works.
Something that happened last month when trying to deploy one of our projects. A look at the web deploy logs showed us the following error message:
Web deployment task failed. ((2/11/2024 15:00:08) An error occurred when the request was processed on the remote computer.)(2/11/2024 15:00:08) An error occurred when the request was processed on the remote computer.Unable to perform the operation. Please contact your server administrator to check authorization and delegation settings.
Time to contact the server administrator... Unfortunately that’s my team in this case. So let’s investigate.
We logged in on the web server and checked the event logs. There we got some extra details:
A tracing deployment agent exception occurred that was propagated to the client. Request ID '13303b1c-00df-4ed1-bc66-5cc6e93048a5'. Request Timestamp: '2/11/2024 6:10:50'. Error Details:
Microsoft.Web.Delegation.DeploymentAuthorizationException: Not able to log on the user '.\WDeployConfigWriter'. ---> System.Runtime.InteropServices.COMException: The user name or password is incorrect. (Exception from HRESULT: 0x8007052E)
And if we checked the security logs, we got the following details:
The computer attempted to validate the credentials for an account.
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: WDeployConfigWriter
Source Workstation: SERVERX
Error Code: 0xC000006A
An account failed to log on.
Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3E5
Logon Type: 8
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: WDeployConfigWriter
Account Domain: BRUSRV181
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A
Process Information:
Caller Process ID: 0x10a0
Caller Process Name: C:\Windows\System32\inetsrv\WMSvc.exe
Network Information:
Workstation Name: SERVERX
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
To explain what is going on, you first need to understand a little bit how Web Deploy works. When you install the Web Deploy extension on your IIS web server, 2 local accounts are created:
- WDeployConfigWriter, which has Write permissions to the IIS server’s applicationHost.config. This is used by delegation rules for createApp, appPoolNetFx and appPoolPipelineMode.
- WDeployAdmin, which is an administrator. This is used by delegation rules for recycleApp.
Normally you don’t need to know and manage these accounts as there are only used locally on the web server instance. Unfortunately due to an unknown reason the WDeployConfigWriter account no longer works.
To fix it I first did a password reset:
- Go to Computer Management –> Local Users and Groups –> Users.
- Right click on the WDeployConfigWriter account and choose Set Password;
After doing that I also updated the password in the Management Delegation UI as described in this (old) post:
- Go to IIS
- Click on Management Service Delegation in the Management section
- There are 3 rules where the WDeployConfigWriter account is assigned to
- Right click on the backupSettings rule and choose Edit…
- On the Edit Rule screen click on Set… next to the credentials
- Reenter the name and the (new) password
- Repeat the steps above for the 2 other rules
That should do the trick…
More information
Microsoft Web Deployment Team Blog - Announcing Web Deploy 2.0 Refresh!