I am currently developing an application (written in vb.net) to assist authorized users manage DHCP servers in our organisation. The application does this be calling powershell scripts to query and configure the DHCP servers.
The configuration of our environment is:
- IIS 8.5 running on Windows Server 2012r2
- Windows Authentication
- Application Pool is running as a domain account in Integrated Pipeline mode. The domain account has been configured for constrained delegation to the DHCP servers.
- The application pool identity and site users have been given "full control" to the application and scripts directories for testing.
- the authenticated user is impersonated programmatically before calling the powershell script using the following code:
Dim winID As System.Security.Principal.WindowsIdentity = CType(HttpContext.Current.User.Identity, System.Security.Principal.WindowsIdentity)
Dim ctx As System.Security.Principal.WindowsImpersonationContext = Nothing
ctx = winID.Impersonate()
Dim rs As Runspace = RunspaceFactory.CreateRunspace()
rs.Open()
Dim rsPipeline As Pipeline = rs.CreatePipeline()
rsPipeline.Commands.AddScript(strScript)
objResults = rsPipeline.Invoke()
rs.Close()
ctx.Undo()
Everything is working as expected BUT only if the user is a member of the "Administrators" group on the IIS server. If they are not a member of the local administrators then the following exception is thrown when they click on the button that calls the
above code:
Access denied
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: Microsoft.Management.Infrastructure.CimException: Access denied
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[CimException: Access denied ]
Microsoft.Management.Infrastructure.Internal.Operations.CimSyncEnumeratorBase`1.MoveNext() +556
System.Linq.Enumerable.SingleOrDefault(IEnumerable`1 source) +121
Microsoft.Management.Infrastructure.CimSession.TestConnection(CimInstance& instance, CimException& exception) +184
[CimJobException: Cannot connect to CIM server. Access denied ]
System.Management.Automation.MshCommandRuntime.ThrowTerminatingError(ErrorRecord errorRecord) +7810839
[CmdletInvocationException: Cannot connect to CIM server. Access denied ]
System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input) +14654780
System.Management.Automation.Runspaces.Pipeline.Invoke() +14
xxxxxxxxxxx.PowershellUtilities.PowershellUtilites.ExecutePSScript() +146
xxxxxxxxxxx.DHCP.GetDHCPScopeInfo() +128
The powershell script being run is a simple one line script:
Get-DhcpServerv4Scope -ComputerName servername.mydomain
If a user logs in to the IIS server they can run the script without any problems. While logged in to the server if they open a browser and enter the URL "http://localhost/sitename" the site and scripts function as expected. However if they enter the URL"http://fqdn_of_server/sitename" the above error is displayed.
I am thinking this is most likely an IIS configuration issue, but any suggestions or advice would be appreciated.