Config Error: This configuration section cannot be used at this path

Question

I've encountered an error deploying a site to a server. When trying to load the home page, or access authentication on the new site in IIS, I get the error:

Config Error: This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

More detail can be found here, in Scenario 7 matches my hex error code.

The solution given on the linked site above is to set Allow for overrideModeDefault in the section mentioned in my error, in the applicationHost.config file. In my case, under Security in system.webServer. But if I look at the applicationHost.config on my local computer, where the site is properly deployed already, that section is set to Deny.

If this solution is correct, how is my local instance running just fine with the same web.config? According to my applicationHost.config, that section should be locked, but it's not. I'd prefer to not change the applicationHost.config file, because there are many other sites running on that server. Is there another solution?

Omland

Answer 1

I had the same problem. Don't remember where I found it on the web, but here is what I did:

• Click "Start button"
• in the search box, enter "Turn windows features on or off"
• in the features window, Click: "Internet Information Services"
• Click: "World Wide Web Services"
• Click: "Application Development Features"
• Check (enable) the features. I checked all but CGI.

Waverley

this error comes when you host mvc 3 or mvc 4 application in windows server 2016 or higher version... to solve it, you need to install, powershell version 2.0 and asp.net 3.5, asp.net 4.5 from add/remove features. – Catania

Answer 2

You can use the IIS Manager to edit these settings. Read more at An Overview of Feature Delegation:

Using the Feature Delegation option from the root of IIS:

You can control each feature's permissions; if you try to use one that is set to read-only, it will give you these overrideMode="Deny" errors:

Tavel

To continue this, what worked for me is to (note this solution is on my DEV box and NOT a Production system): -> Sort by Delegation -> Find all of the Read Only types -> Set them to Read/Write – Deason

There are two seemingly different solutions posted here both of which are required. The first being, install the "Application Server" and "Web Server" Support features. The second being, check the delegation settings and change the offending setting to Read/Write from read only. Important to NOTE: The offending config may not be available in the Delegation features unless the correct Support Features are installed. In my case, "Authentication - Anonymous" was the issue, and this delegation feature did not show up until I installed the Application Server feature. – Turmoil

The issue for me was in the authentication section, in IIS 10 in windows 10. This link has helped me. knowledgebase.progress.com/articles/Article/… – Malamud

It's interesting to note that, when you override your site deletagion in the IIS manager console, what it does, is editing your actual applicationhost.config, and add that at the end of it, with "path" for the site you need to override, followed by the sections you want to. In case you prefer editing your config file without using the iis console. <location path="Default Web Site" overrideMode="Allow"> <system.webServer> <security> <authentication> <anonymousAuthentication /> <basicAuthentication /> </authentication> </security> </system.webServer> </location> – Pilarpilaster

I had to set Authentication- Anonymous to read/write and from that point, I could override from my site configure edit and unlock the logon Method – Aeneous

Answer 3

For Windows Server 2012 and IIS 8, the procedure is similar.

The Web Server (IIS) and Application Server should be installed, and you should also have the optional Web Server (IIS) Support under Application Server.

Uppercut

Just to clarify, the "Web Server (IIS) Support" feature checkbox is not under the 'Application Server' node in the pic above. It will show after you perform several 'next' and pass the Server Roles and Features on the left nav bar and get to 'Role Services' (doesn't appear in the pic above but will appear for you after several 'next'). This drove me crazy :P – Ineradicable

for me the options only appeared after I first added the Application Server rule then restarted the Add Roles and Features Wizard – Highborn

Answer 4

Browse to “C:\Windows\System32\inetsrv\config” (you will need administrator rights here) Open applicationHost.config

Note: In IISExpress and Visual Studio 2015 the applicationHost.config is stored in $(solutionDir).vs\config\applicationhost.config

Find the section that showed up in the “config source” part of the error message page. For me this has typically been “modules” or “handlers”

Change the overrideModeDefault attribute to be Allow

So the whole line now looks like:

<section name="modules" allowDefinition="MachineToApplication" overrideModeDefault="Allow" />

After saving the file, the page loaded up fine in my browser.

Further reading on 64-bit environments: Editing applicationHost.config on 64-bit Windows

Cretan

For 64-Bit Windows, you need to go through notepad.exe and open up %SystemRoot%\System32\inetsrv\config to get the correct copy of the file – Jarietta

Answer 5

1. Open "Turn windows features on or off" by: WinKey+R => "optionalfeatures" => OK

2. Enable those features under "Application Development Features"

Tested on Win 10 - But probably will work on other windows versions as well.

Kronos

For us IIS noobs, verifying that the correct version asp.net is actually installed should be the first step. – Hyden

This suggestion worked for me. In my case, I enabled the following under Application Development Features 1) ASP.NET 4.8 which enabled the below 2) .NET Extensibility 4.8 3) ISAPI Extensions 4) ISAPI Filters – Sande

This repeats the solution from the accepted answer from 5 years prior... – Leanoraleant

Didn't work on Server 2022 – Suzette

Answer 6

You need to unlock handlers. This can be done using following cmd command:

%windir%\system32\inetsrv\appcmd.exe unlock config -section:system.webServer/handlers

Maybe another info for people that are getting this error on IIS 8, in my case was on Microsoft Server 2012 platform. I had spend couple of hours battling with other errors that bubbled up after executing appcmd. In the end I was able to fix it by removing Web Server Role and installing it again.

Bonina

this worked for me also for system.webServer/security/ipSecurity – Disability

Bingo. Had to run as administrator. – Keely

I had to do this for -section:system.webServer/modules as well. – Dinerman

worked for me - I was looking to set /section:access /sslFlags:SslNegotiateCert and found I had to use the above with -section:access which reported as Unlocked section "system.webServer/security/access"... – Flyer

Answer 7

I ran these two commands from an elevated command prompt to solve this problem:

%windir%/system32/inetsrv/appcmd unlock config /section:anonymousAuthentication

%windir%/system32/inetsrv/appcmd unlock config /section:windowsAuthentication

Carrew

Works for me, but why? – Foredo

If you want to see what this command actually does, then these same settings can be changed from the Management -> Configuration Editor section in IIS. The dropdowns at the top and the panel on the right control what sections to unlock in the app web.config, web site web.config, and applicationhost.config. – Promotion

<windowsAuthentication enabled="true" /> Personally, I have this line for using Windows authentication to access my local database on MSSQL. So enabling this section is helped – Strapper

Answer 8

As per my answer to this similar issue;

Try unlocking the relevant IIS configuration settings at server level, as follows:

1. Open IIS Manager
2. Select the server in the Connections pane
3. Open Configuration Editor in the main pane
4. In the Sections drop down, select the section to unlock, e.g. system.webServer > defaultPath
5. Click Unlock Attribute in the right pane
6. Repeat for any other settings which you need to unlock
7. Restart IIS (optional) - Select the server in the Conncetions pane, click Restart in the Actions pane

Thach

Answer 9

The best option is to Change Application Settings from the Custom Site Delegation
Open IIS and from the root select Feature Delegation and then select Application Settings and from the right sidebar select Read/Write

Casandracasanova

My IIS manager does not have many of these features. I think I have to add them via windows features. I had all of them selected (black square box) but when I click on it none of the options were selected! I have never seen this using all Windows OS. Shame on you Microsoft! Wasted a bunch of time. MAKE SURE ALL WINDOWS FEATURES ARE CHECKED THAT ARE DESIRED..DO NOT USE BLACK SQUARE SELECTION – Adjacency

Or understand what the "black square" means when you're installing software on your server. – Dugan

May I add step 2.1 -> click "custom site delegation" on the right, then choose which site you want to allow override from the top dropdown. I suggest to not allow overwrite on all sites, but only the site you need to. Then, continue to step 3. – Pilarpilaster

Answer 10

This Did the trick for me, for IIS 8 Windows server 2012 R2

Go to "Turn on Features"

Then go to all default setting , Next, Next, Next etc..

Then, select as shown below,

Then reset IIS (optional) but do it safer side.

This is an additional solution as its a generic problem everyone have different of problem and thus different solution. Cheers!

Amentia

This repeats the solution from the top/accepted answer from 5 years prior. https://mcmap.net/q/45004/-config-error-this-configuration-section-cannot-be-used-at-this-path – Leanoraleant

Answer 11

On Windows Server 2012 with IIS 8 I have solved this by enabling ASP.NET 4.5 feature:

and then following ken's answer.

Contrapose

In PowerShell: Add-WindowsFeature Web-Asp-Net45 – Helainehelali

Answer 12

To fix this open up the IIS Express applicationhost.config. This file is stored at C:\Users[your user name]\Documents\IISExpress\config\applicationhost.config

Update for VS2015+: config file location is $(solutionDir).vs\config\applicationhost.config

Look for the following lines

<section name="windowsAuthentication" overrideModeDefault="Deny" />
<section name="anonymousAuthentication" overrideModeDefault="Deny" />
<add name="WindowsAuthenticationModule" lockItem="true" />
<add name="AnonymousAuthenticationModule" lockItem="true" />

Change those lines to

<section name="windowsAuthentication" overrideModeDefault="Allow" />
<section name="anonymousAuthentication" overrideModeDefault="Allow" />
<add name="WindowsAuthenticationModule" lockItem="false" />
<add name="AnonymousAuthenticationModule" lockItem="false" />

Save it and refresh Asp.net Page.

Nissen

For future reference. C:\Windows\System32\inetsrv\config\.. – Chandelier

In case of multiple solutions in the folder you need to open $(solutionDir).vs\[SolutionName]\config\applicationhost.config – Pleura

Answer 13

In our case on IIS 8 we found the error was produced when attempting to view Authentication" for a site, when:

1. The server Feature Delegation marked as "Authentication - Windows" = "Read Only"
2. The site had a web.config that explicitly referenced windows authentication; e.g.,

Marking the site Feature Delegation "Authentication - Windows" = "Read/Write", the error went away. It appears that, with the feature marked "Read Only", the web.config is not allowed to reference it at all even to disable it, as this apparently constitutes a write.

Crouse

Answer 14

Seems that with IIS Express and VS 2015, there's a copy of the applicationHost.config file at $(solutionDir).vs\config\applicationhost.config so you'll need to make changes there. See this link: http://digitaldrummerj.me/iis-express-windows-authentication/

Make sure these lines are changed per below:

<section name="windowsAuthentication" overrideModeDefault="Allow" />
<section name="anonymousAuthentication" overrideModeDefault="Allow" />
<add name="WindowsAuthenticationModule" lockItem="false" />
<add name="AnonymousAuthenticationModule" lockItem="false" />

Boiardo

Answer 15

In my case it was that on server was not enabled "HTTP Activation" under .NET Framework Features. So for Windows Server 2012 the solution which worked for me was:

Server Manager -> Add roles and features -> Features -> make sure that under .NET Framework of version you want to use is checked "HTTP Activation"

Ohg

not worked @Ray in Windows 7, 8, 10, 2008 server, 2012 server ? – Abducent

Answer 16

I noticed one answer that was similar, but in my case I used the IIS Configured Editor to find the section I wanted to "unlock".

Then I copied the path and used it in my automation to unlock it prior to changing the sections I wanted to edit.

. "$($env:windir)\system32\inetsrv\appcmd" unlock config -section:system.webServer/security/authentication/windowsAuthentication
. "$($env:windir)\system32\inetsrv\appcmd" unlock config -section:system.webServer/security/authentication/anonymousAuthentication

Tissue

Answer 17

The Powershell way of enabling the features (Windows Server 2012 +) - trim as needed:

Install-WindowsFeature NET-Framework-Core
Install-WindowsFeature Web-Server -IncludeAllSubFeature
Install-WindowsFeature NET-Framework-Features -IncludeAllSubFeature
Install-WindowsFeature NET-Framework-45-ASPNET -IncludeAllSubFeature
Install-WindowsFeature Application-Server -IncludeAllSubFeature
Install-WindowsFeature MSMQ -IncludeAllSubFeature
Install-WindowsFeature WAS -IncludeAllSubFeature

Barquentine

Answer 18

The error says that the configuration section is locked at the parent level. So it will not be directly 1 config file which will resolve the issue, we need to go through the hierarchy of the config files to see the inheritance Check the below link to go through the File hierarchy and inheritance in IIS

https://msdn.microsoft.com/en-us/library/ms178685.aspx

So you need to check for the app config settings in the below order

1. ApplicationHost.config in C:windows\system32\inetsrv\config. Change the overrideModeDefault attribute to be Allow.
2. ApplicationName.config or web.config in the applications directory
3. Web.config in the root directory.
4. Web.config in the specific website (My issue was found at this place).
5. Web.config of the root web (server's configuration)
6. machine.config of the machine (Root's web.config and machine.config can be found at - systemroot\MicrosoftNET\Framework\versionNumber\CONFIG\Machine.config)

Go carefully through all these configs in the order of 1 to 6 and you should find it.

Dirkdirks

Answer 19

I needed to change the SSL settings on a subfolder when i got this nice message. In my case following action helped me out.

Opened C:\Windows\System32\inetsrv\config\applicationHost.config

And changed the value from overrideModeDefault="Deny" to "Allow"

<sectionGroup name="system.webServer">
 ...
    <sectionGroup name="security">
        <section name="access" overrideModeDefault="Allow" />
    </sectionGroup>

Haarlem

Answer 20

In my case, I got this error because I was operating on the wrong configuration file.

I was doing this:

Configuration config = serverManager.GetWebConfiguration(websiteName);
ConfigurationSection serverRuntimeSection = config.GetSection("system.webServer/serverRuntime");
serverRuntimeSection["alternateHostName"] = hostname;

instead of the correct code:

Configuration config = serverManager.GetApplicationHostConfiguration();
ConfigurationSection serverRuntimeSection = configApp.GetSection("system.webServer/serverRuntime", websiteName);
serverRuntimeSection["alternateHostName"] = hostname;

in other words, I was trying to operate on the website's web.config instead of the global file C:\Windows\System32\inetsrv\config\applicationHost.config, which has a section (or can have a section) for the website. The setting I was trying to change exists only in the applicationHost.config file.

Loser

Answer 21

In my case, it was something else.

When I loaded the solution in a new version of Visual Studio, VS apparently created a new project-specific applicationhost.config file:

MySolutionDir\.vs\config\applicationhost.config

It started using the settings from the new config, instead of my already customized global IIS Express settings. (\Users\%USER%\Documents\IISExpress\config\applicationhost.config)

In my case this was the setting that needed to be set. Of course it could be something else for you:

<section name="ipSecurity" overrideModeDefault="Allow" />

Odo

Answer 22

Received this same issue after installing IIS 7 on Vista Home Premium. To correct error I changed the following values located in the applicationHost.config file located in Windows\system32\inetsrv.

Change all of the following values located in section -->

<div mce_keep="true"><section name="handlers" overrideModeDefault="Deny" /> change this value from "Deny" to "Allow"</div>
<div mce_keep="true"><section name="modules" allowDefinition="MachineToApplication" overrideModeDefault="Deny" /> change this value from "Deny" to "Allow"</div>

Germander

Answer 23

Can You try this:

Go to application path where you're getting deny error, right click

Properties->Security tab

In that, change the permissions and check the checkbox read and write. Then it will work without any error hopefully.

Orpha

Answer 24

I had the similar issue, but I used the following powershell script which helped me to achieve above steps in on button click.

#Install IIS
Import-Module ServerManager

Add-WindowsFeature Web-Server, Web-Asp-Net45, Web-Mgmt-Console, Web-Scripting-Tools, NET-WCF-HTTP-Activation45, Web-Windows-Auth

the list of features can be added or removed based on the requirement.

Igbo

Answer 25

For Windows Server 2008 and IIS 7, the procedure is similar. please refer to this: http://msdn.microsoft.com/en-us/library/vstudio/bb763178(v=vs.100).aspx

in add role service, u will see "Application Development Features"

Check (enable) the features. I checked all.

Moonlight

Answer 26

In my case I was getting this error when attempting to update the authentication settings in IIS also in addition to browsing. I was able to remove this error by removing the authentication setting from the web.config itself. Removing a problematic configuration section may be less invasive and preferable in some cases than changing the server roles and features too much:

Section Removed:

    <security>
        <authentication>
            <windowsAuthentication enabled="true" />
        </authentication>
    </security>

Tissue

Answer 27

I had the same problem. I deleted this section from the web.config file.

<modules>
      <remove name="WebDAVModule" />
</modules>

Medin

Solved mine issue as well – Transience

Answer 28

I had an issue where I was putting in the override = "Allow" values (mentioned here already)......but on a x64 bit system.......my 32 notepad++ was phantom saving them. Switching to Notepad (which is a 64bit application on a x64 bit O/S) allowed me to save the settings.

See :

http://dpotter.net/technical/2009/11/editing-applicationhostconfig-on-64-bit-windows/

The relevant text:

One of the problems I’m running down required that I view and possibly edit applicationHost.config. This file is located at %SystemRoot%\System32\inetsrv\config. Seems simple enough. I was able to find it from the command line easily, but when I went to load it in my favorite editor (Notepad++) I got a file not found error. Turns out that the System32 folder is redirected for 32-bit applications to SysWOW64. There appears to be no way to view the System32 folder using a 32-bit app. Go figure. Fortunately, 64-bit versions of Windows ship with a 64-bit version of Notepad. As much as I dislike it, at least it works.

Morceau

Answer 29

I had the same issue.

• Resolved it by enabling Application Server feature. Restarted iis after that.

Redletter

How-to enabling Application Server feature ? in Windows Server 2008 o 2012 ? Windows 7,8,10? using Powershell? – Abducent

Answer 30

This worked for me Also in IIS 8 you can solve this problem by changing the server to IIS Express. Goto debug->Properties In the Web select the server as IIS Express from the dropdown and then rebuild the solution

Lafrance

Answer 31

To make a change at Application Level (Web.Config):

Please remove the Trust Level from the web.config:

Actually I was getting this error when I was trying to host my Website on the Hosting Server where I don't have control on their Server. Removing the above line from my Application web.config solved my issue.

Laws

Answer 32

The following worked for me:

Go to project properties. Web tab. Set to Local IIS and set specific page.

I have Windows 7 and Visual Studio 2013.

Ululate

Answer 33

i solved this issue

go to cmd and execute aspnet_regiis -i

hope it helpful to someone.

Ivonneivor

i have tested on window 7 – Ivonneivor

Answer 34

Before reinstalling iis and possibly all of your sites, go to: C:\inetpub\history

There should be number of folders (example: CFGHISTORY_0000000029). Each time a root config file is modified, and entry is made in there. (by default backups of the last 10 modifications are saved)

Look for a backup folder that has the right date and time for it, Click on it and see if there is a file called; applicationhost.config

Compare this to your current applicationhost.config file, or replace your current version with it (make a backup first!!!).

I recently had my localhost iis file modified by a windows 2004 update package, which locked a few features at the root (such as handlers), which prevented localhost sites from working - hence my search.

If you open the file in Visual Code, you can see each area that is locked with a overrideModeDefault="Deny"

This might get you a step closer, and also a way to recover if this file ever gets corrupted.

Sightless

Answer 35

Adding following key in registry solved my issue:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ASP.NET_64\Performance

When I tried these steps I kept getting error:

1. Search for "Turn windows features on or off"
2. Check "Internet Information Services"
3. Check "World Wide Web Services"
4. Check "Application Development Features"
5. Enable all items under this

Then i looked at event viewer and saw this error:Unable to install counter strings because the SYSTEM\CurrentControlSet\Services\ASP.NET_64\Performance key could not be opened or accessed. The first DWORD in the Data section contains the Win32 error code.

To fix the issue i manually created following entry in registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ASP.NET_64\Performance

and followed these steps:

1. Search for "Turn windows features on or off"
2. Check "Internet Information Services"
3. Check "World Wide Web Services"
4. Check "Application Development Features"
5. Enable all items under this

Pendentive