How can I debug a VB6 IIS Application on Windows 7 64-bit

Question

I have a need to be able to debug a Visual Basic 6 IIS Application on Windows 7 64-bit. Not just for a single problem but for continuing development.

An attempt to debug results in an error "An unspecified error has occurred" from the WebClass runtime.

If I do not debug and simply access the compiled webclass the page loads just fine. Therefore, I don't believe there is anything wrong with the registration / configuration of the application but rather this is somehow related to Windows OS security blocking the VB6 IDE from hooking into IIS and allowing it to debug.

Here are all of the things that I have tried:

1. Disabled User Account Control (UAC) and rebooted.
2. Modified DCOM component security for machine debug manager (MDM) and assigned "Everyone" launch and activate permissions.
3. Manually added DCOM entry for "70F214BA-94E2-4bdf-8F30-32CB4A905E4D" which is the VB6 IDE and assigned "Everyone" launch and activate permissions.
4. Disabled Windows Firewall
5. Ran the application (VB6.exe) in compatibility mode of Windows XP SP3 with run as administrator option.
6. Created a new IIS application pool with an identity set to an administrator account. Set the application pipeline mode to classic and enabled 32-bit legacy application support.

This exhausted my extensive experience of things to try. If I create a VB6 Windows Application or ActiveX control I can easily launch and debug.

I've experienced a very similar problem on Windows Server 2003 although a fresh install of W2K3 resolved the problem.

In the Windows System event viewer log there are 2 duplicate entries for Event ID 10004 as follows:

DCOM got error "1326" and was unable to logon DOMAIN\User in order to run the server: {70F214BA-94E2-4BDF-8F30-32CB4A905E4D}

Where DOMAIN\User is my domain account and the GUID mentioned above is the DCOM entry I added for VB ASP Debugging.

The only extra information I have to offer is that Windows 7 64-bit is running in a VM although I am remoted to the console while attempting to debug. I've experienced problems debugging on VMs without a console connection.

If anyone can offer any further suggestions of things to try I would greatly appreciate it.

If anyone can figure this out and succesfully debug an IIS web application on a Windows 7 OS depicting the necessary settings I will offer the current bounty of 300 points!

Neuron

Hi Warren, I see you're putting a bounty on this again. One thing I noticed -- you don't mention what SP of VS6 you're using. I know it's overly simple, but are you running SP6? – Womanhater

Warren: another piece of info: I can do a Run -> Start without W3SVC or IISAdmin services even started. That implies that the issue is something to do with VB6, as opposed to OS blocking communication with IIS. – Womanhater

Have you tried running your app with IIS Express? That way you can run IIS in your own user context (the same context under which the VB6 IDE/debugger would run)? – Evin

One last ditch effort: It seems you can get an unspecified error if your application event log is full, and set to not overwrite events. Try clearing it, and see if that makes any difference. – Womanhater

Yes there are related errors in the event log. I've updated the original question. However, during one of my first troubleshooting attempts was when I added the DCOM entry to try and resolve what appeared to be a security problem with launching the VB debugger. The information may still help? – Neuron

@WarrenRox The GUID from error event is the one for VB6.exe (IDE), but "...unable to logon..." error event usually means that either username or password is wrong. I do not quite understand where it comes from in this scenario, though. Bad password must have been entered and stored for DOMAIN\User somewhere (assuming you can successfully logon interactively with this credentials to your VM). What do you have on Identity tab in DCOM config for this "VB ASP Debugging" component? – Ronaldronalda

Yes I have. This problem is easily reproducable on any Windows 7 64-bit machine with Visual Studio 6 SP6 whether the machine is on a domain or a simple standalone PC. I have tried with a local admin account and I have tried giving "Everyone" all COM security permissions. – Neuron

@WarrenRox Error you see in system events is not about permissions, so it is not remedied by changes you describe. – Ronaldronalda

The error message will change indicating the different user name. I'm not sure if this helps but if I remove the DCOM entry that I had manually added for "VB ASP Debugging" then there are no event messages logged. The only error is the "An Unspecified error has occurred" from the VB run time displayed in the IDE. – Neuron

I really appreciate the effort you took to replicate the problem! It's easy to replicate but would certainly have taken time to setup. The primary machine in which I wish to do the development is Win7 64-bit and I truly wish to avoid having to run a VM. If you can find a way possible either via IIS express or anything that makes it possible to debug on the 64-bit OS you will have answered my question successfully. How did you know that it was not a security issue but rather IIS? I couldn't find any trace of why the failure so I assumed security. – Neuron

Ilya, if you could post your findings as an answer to the question I would feel best that you receive the bounty for your efforts in at least identifying it is not a security issue. This is at least a step forward. – Neuron

Microsoft article support.microsoft.com/kb/259725 – Towhead

Thank you but that does not resolve the problem. I've known about that problem since the days of Windows Server 2003 and it does work in that scenario. However, I'm specifically talking about Windows 7 here. – Neuron

Answer 1

I believe it is not possible to debug a VB6 IIS Application in IDE on any version of Windows newer than Windows XP (probably, situation is similar for server flavor of Windows). The root cause of the problem seems to be major differences between IIS 6 and IIS 7+. Of course, there is no official documentation on the topic, thus I shall go into more details below.

First, it makes sense to recap the problem. Many good folks seem to forget that IIS Application is an exact term referring to special type of VB6 project in this context. I was able to reproduce the error following these steps on Win7 Ultimate x64 SP1, Win7 Ultimate x86 SP1, and Vista Enterprise x86 SP2:

1. Install VB6 and SP6.
2. Create new IIS Application project:
3. Save the project.
4. Choose Run -> Start (F5) to debug the project.
5. Choose any option on Debugging tab and press OK:

Immediately after that there is error message in VB6 IDE:

Let us examine what happens when the same scenario is executed on Windows XP. When one starts debugging VB6 IIS Application:

• VB6 IDE starts IIS service if it is not running:

• VB6 IDE prompts to choose IIS virtual directory:

All this happen on Windows XP before WebClass is activated. Process doesn't get to this stage on Windows 7.

It is clear that VB6 IDE attempts to perform some administrative tasks in IIS in order to be able to debug a WebClass. One can delve a bit deeper with help of Process Monitor and API Monitor. It is clear then that VB6.exe relies on COM interfaces of IIS Admin Service. Bad news is that IIS 7+, unlike previous versions, doesn't use Metabase and there is no IIS Admin Service in IIS 7+. One can install IIS Metabase and IIS6 compatibility component that, in theory, should enable applications that use Metabase to continue working with IIS 7+:

Unfortunately, installing it doesn't resolve the problem.

There are suggestions that your problem can be caused by inadequate launch and activation permissions for COM components. I am afraid that all those suggestions are futile. Errors of that kind are always accompanied by related error events in System event log. There are no such events in this case.

Ronaldronalda

You should be awarded the bounty for the answer but I'm not sure where the bounty went? – Neuron

Answer 2

I recently experienced the same problem on my Windows 7 64 bit machine. The solution that worked for me was to check the windows event log (system) for the specific DCOM error. This is the error that I had:

The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {17C2D338-9569-4022-8AF2-52A3A124F22D} and APPID {17C2D338-9569-4022-8AF2-52A3A124F22D} to the user NT AUTHORITY\IUSR SID (S-1-5-17) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

The key point for me was to give the IUSR built-in account Launch and Activation permission. After attemtpting to give this user permission to the individual DCOM components and failing, I decided to add the user to the default DCOM permissions for the machine. You can do this as follows:

Run dcomcnfg. Right click on the Console Root/Component Services/Computers/My Computer node. Select Properties. Select the 'COM Security' tab. Click the 'Edit Default' under the 'Access Permissions' group. Click 'Add'. Enter the User indicated in your event log (mine was IUSR). Click OK. Repeat for the 'Launch and Activation Permissions' group. Select OK on all the dialogs.

I did not have to reboot my machine for these setting to take effect. I used the same method to debug the VB6 dll that I used on XP i.e. run the dll under VB6 (unattended execution), set a break point, navigate to a page that accessed the dll, and wait for the breakpoint to be hit. Hope this helps.

Deflect

Thank you very much for the suggestion. I do in fact see the errors in the Windows System Event log as follows:DCOM got error "1326" and was unable to logon DOMAIN\USERID in order to run the server: {70F214BA-94E2-4BDF-8F30-32CB4A905E4D}. I'm on a domain and the error message includes the real domain\username. However I've gone to the point of adding "Everyone" to the DCOM permissions and I still receive the same error in the IDE when attempting to debug and the same error over and over in the event log. I've searched the registry and the GUID listed is actually VB6. – Neuron

This solution, what helped me. I HAD to reboot my machine, after the changes, it did not work otherwise, but after the reboot, all started working like a charm. Thank you, for sharing! – Salter

I have rebooted my machine several times during the troubleshooting process without any luck. If you can prove that you were actually succesful in debugging an IIS web application on a Windows 7 OS depicting the necessary settings I will offer a bounty of all my reputation points. This offer is extended to anyone who can to the same. – Neuron

@Deflect Are you sure you were debugging IIS Application as opposed to mere VB6 component used from ASP application? IIS Application is a special type of VB6 project. – Ronaldronalda

Thank you for the answer, yuben. 2 important modifications: 1) my error messages were referring to IWAM_machine user instead of IUSR, so I had to grant that user both file and DCOM launch rights also. 2) The error component, "Machine Debug Manager" was set to use custom DCOM permissions, so modifying defaults alone wouldn't have helped. I did do those, but also added both I* users to that object's specific permissions. After a reboot, it works! HTH someone. – Vacuole

Answer 3

Don't know if this helps you further.. I am researching the same issue my own use.

In even viewer I see: The machine-default permission settings do not grant Local Activation permission for the COM Server application with

CLSID 
{08855658-7A0B-4EF9-99B2-0AF875B3E62A}

and

APPID 
{08855658-7A0B-4EF9-99B2-0AF875B3E62A}

to the user NT AUTHORITY\IUSR SID (S-1-5-17) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

..so I attempt to grant Local Activation to "Everyone" - Just to see if I can make it go away. -I Can't.

Then I grant Local Activation as a default in Component services / my Computer (properties) COM Security, Launch and activation permissions

I still can't debug, but I no longer get errors in event viewer. In browser I get

Server object error 'ASP 0178 : 80070005'

Server.CreateObject Access Error

/app.asp, line 4

The call to Server.CreateObject failed while checking permissions. Access is denied to this object.

The CLSID above is my vb6 app, but registry points to vb6debug.dll (which looks right). progID match etc.

Granted permissions to everyone on the vb6debug.dll and other files.

Next step is procmon or something like that to see what happens.

Re

I appreciate the information. However, I have already opened up the COM security settings to "Evyerone" for everything as well. I do not have any events logged in the event viewer indicating a problem with security however. All I see is the "Access Denied" message from the VB IDE. I've tried procmon as well but nothing is sticking out. – Neuron

Well the bounty has expired and I did not receive an answer that solved my problem. However, based upon the comments received I would have to say that you provided the most in depth attempt at identifying the underlying security issue. I am therefore awarding you the bounty. However, please let me know if you finally resolve the issue for yourself and update with the answer. Thanks! – Neuron

@BoAndersen Are you sure you were debugging IIS Application as opposed to mere VB6 component used from ASP application? IIS Application is a special type of VB6 project. – Ronaldronalda

Answer 4

Have you considered writing a log file? It's pretty straight forward and you can begin just where the code is most likely to cause an error. I suggest creating a function that takes a few parameters such as a Sub/Function name, an Err object, and an optional extra string so you can include additional information such as what step your code was in. In your error handler call your function passing your parameters.

Enate

The application does even launch so it is not possible to write a log file. The error occurs immediately after pressing F5 to start debugging. The problem occurs with any IIS application regardless of the code. – Neuron

@WarrenRox I was suggesting using logging while your app was running, not while you were attempting to debug. If you need to do this because you are developing the app then set a variable to turn the logging on and off then right the values of variables and function results to your log while developing, turn it off for production. If this doesn't suit you then blow it off as a crackpot idea. – Enate

I think I understand what you are suggesting. You are providing a solution for debugging a particular problem by using logging at runtime. However, my situation is not that I need to debug a specific problem but rather the fact that active development is taking place on this product. Therefore, without the ability to launch in debug mode it makes writing code much more tedious/expensive as you can imagine. – Neuron

Answer 5

Man, can I sympathize. I spent almost 3 man-days on this, and still don't have a solution that I'm incredibly happy with, but it does work, so I've "given up" finding the correct solution, and went with this, because I just can't waste any more resource time.

Under IIS Manager, click on virtual directory -> Authentication
- disable anonymous authentication
- enable basic authentication

Browse to app, enter domain or workstation credentials with enough privilege to make the app work based on what is set for the filesystem security where the app lives.

This effectively means that I have to authenticate myself to the virtdir every time I start debugging for the first time, but it's a small price to pay to finally have debugging functional again.

Womanhater

This does not appear to solve the problem. It is possible I am misunderstanding your suggestion. The virtual directory requires authentication such as Windows or Basic auth as it is the only way that debugging will work. However, when browsing to the web application from IIS directly it does not start debugging from VB and the same problem exists when you try to start debugging. – Neuron

@WarrenRox Load VB IDE with project, click start. Set a breakpoint somewhere on the default page. Browse to web app, enter credentials. Breakpoint should hit. – Womanhater

@WarrenRox Also, what are your perms on the directory pointed to by the virtual directory? I gave INTERACTIVE, Authenticated Users, Users, and SYSTEM full control. – Womanhater

I appreciate your comments however, if you read the question you would see I am unable to click start and debug the application. This immediately causes the "An unspecified error has occurred" to occur. I have cranked up permissions to "full control" to all users to the virtual directory as well. Still receive the same error. – Neuron

Hrmm.. I just re-read the question to make sure that I wasn't crazy, and don't see any mention of you being "unable to click start" (and therefore having that be related to receiving the message.) From your wording, your post makes it sound as if you received this error in the browser (from IIS), as opposed to the IDE. – Womanhater

From above: An attempt to debug results in an error "An unspecified error has occurred" from the WebClass runtime. – Neuron

@LynnCrumbling Are you sure you was debugging IIS Application as opposed to mere VB6 component used from ASP application? IIS Application is a special type of VB6 project. – Ronaldronalda

Answer 6

Could you copy the information sent into the VB6 part of the application and test that from the console?

I mean, that's gross, but we are talking about debugging a hybrid IIS VB6 application.

Arcane

I'm not sure I understand what you are suggesting. Do you mean run something such as procmon to identify what the IDE is attempting to do when launching? – Neuron

No I'm thinking of just replicating the Webclass code somewhere you can debug it. Of course, the real answer is likely to be: rebuild the application in something other than VB6. – Arcane

Sure it would be possible to tackle debugging in a piece meal approach by replicating some individual methods outside of the IIS application although there wouldn't be any way to access the Request/Response/Server object instances (or process tag or user events in custom web items). My theory remains that there must be a way to simply debug it with an OS security level tweak. – Neuron

Answer 7

I think you can be pretty sure it's not an issue that Microsoft doesn't want it to work, but simply that it can't work. Are you aware of this document?: http://msdn.microsoft.com/en-us/vstudio/ms788708.aspx

It states:

The Visual Basic 6.0 IDE has never been offered in a native 64-bit version, nor has the 32-bit IDE been supported on 64-bit Windows. VB6 development on 64-bit Windows or any native architecture other than 32-bit is not and will not be supported.

I've tried as well and failed so opted to run a 32-bit OS in a VM and then it works flawlessly. I think it's due to how the debugger hooks into the kernel to be able to run the debugger.

Leland

I fully understand that it is not supported. However, I'm hoping to find someone that is clever enough to understand the underlying issue and come up with a feasible workaround. Everything except IIS Web applications seem to work/debug just fine. I've actually running the VB IDE in a VM for the time being although I find it less than desirable to have to run a development environment in a VM if I could use my main desktop. I.e. don't want to miss MSN messages, emails or generally using multiple monitors, etc. Nonetheless your comment is valid and appreciated. – Neuron

Answer 8

I had this problem today September 14, 2012 and managed to solve it in the simplest way possible, I have debug dlls I need visual basic 6.0 with XP I had no problem but I changed it to windows 7 and there was the problem with iis7, I read in many forums and blogs but nothing I was, even I did this blog, nor, in the end I fixed the problem as follows: Component Services-> Computers-> right Click Properties-> then click the Security tab COM-> section Launch and Activation permissions-> Edit Default -> and then add the Local Service account and gave all permissions. I clarify, for me it worked to debug the dll in visual basic 6.0 locally, but not if it is good or the only solution, I think I did well this should be done over what they say on the other forums , is now well on Microsoft http://support.microsoft.com/kb/899965/es page says the same thing but said that adding the NETWORK SERVICE account as I did and I worked for the mistake that I commanded the event Viewer is:

"Setting permissions set by default on your computer does not grant Local Activation permission to the COM Server application with CLSID {95D14525-F934-4D4F-9B33-2CE753FAF3B0} and APPID {95D14525-F934-4D4F-9B33-2CE753FAF3B0} the user NT AUTHORITY \ LOCAL SERVICE with SID (S-1-5-19) in the address LocalHost (with LRPC). This security permission can be modified using the Component Services administrative tool "

You see says NT \ AUTHORITY \ NETWORK SERVICE LOCAL SERVICE account bone.

Well that's all.

Arielariela

First off, thank you very much for providing a recommendation solution to this problem! I tried your recommendation of adding "Local Service" account with launch and activate permissions and I still receive "An unspecified error has occurred" when attempting to lauch any IIS application for debug. Is there something I'm still missing with your solution? – Neuron

In addition you have to do what it says this page support.microsoft.com/kb/259725/en-us – Lampoon

I had tried added the VB ASP Debugging to DCOM with the appropriate security when I had the original problem. This does not resolve it. – Neuron

@Arielariela Are you sure you were debugging IIS Application as opposed to mere VB6 component used from ASP application? IIS Application is a special type of VB6 project. – Ronaldronalda

Answer 9

It sounds like you want the VB6 IDE to fire in the debugger when the app instance is created, and that's failing. Have you tried starting the VB6 IDE in debug mode to host your COM component, set a breakpoint within your source, and then see if accessing the page that uses the component will then cause the breakpoint in the debugger to be hit? That is, take the activation of the VB6 IDE out of the loop - having it running should just cause the CLSID for the app to point to the runtime instance of the IDE as the COM host.

Been a long time since I did dev in VB6, so some of the details may be sketchy, but I do remember that debugging COM servers took some gymnastics, and among one of the solutions was running a separate instance of VB as the COM out-of-process server host.

Alethaalethea

I appreciate your feedback. However, as indicated I wish to debug the IIS Application and it will not start in debug mode. I believe I can launch a simple COM DLL in the VB6 IDE and step into the code once the IIS Application calls it. But the problem is that I need to be able to debug the actual IIS application and it will not launch with the above generic error. – Neuron

Warren, I came across this KB article that dealt specifically with issues arising from debugging VB6 WebClass apps and the problems that can arise from them. You have probably already gone through these steps, but I'll post the link here for reference just in case it includes information you might not have had previously: support.microsoft.com/default.aspx?scid=kb;EN-US;259725 – Alethaalethea

Thanks. I have read that article years ago back in Windows 2000 and XP days and it was very relevant to those operating systems. However, the security model in Windows 7 seems to be completely different and since VB6 no longer has MS support there will never be a new similar KB article for Windows 7. Alas, it is up to the dedicated VB6 fans to plug away at this one until someone finds a solution. Thanks. – Neuron

I think it may end up being less about Win7's security being different (although it is with UAC) than it is IIS7.x and its architecture, app pools, managed handlers, etc. being such entirely different beasts now. I feel for ya! I had many, many productive years in VB6 apps, and squeezing every last bit of capability from it. – Alethaalethea

You're absolutely correct. One of the things I made sure of was to install the IIS 6 compatibility options in IIS 7.5. This allowed me to set 32 bit support for ASP applications, etc. So somewhere in the bowels of IIS 7.5 and Windows 7 there is a security issue preventing the launch of a debugger. – Neuron