Troubleshooting MS web deploy ACL permission error

Question

I have been trying to get my website deployed on a new VPS running windows server 2012/IIS8. Visual studio can connect and creates the directory structure then fails. Looking at the server logs I get the error described in the following link - scroll to bottom.

http://www.iis.net/learn/publish/troubleshooting-web-deploy/troubleshooting-common-problems-with-web-deploy

5/12/2011 11:31:41 AM) An error occurred when the request was processed on the remote computer.
The server experienced an issue processing the request. Contact the server administrator for more information.
This particular error does not give you much to go on, but the picture becomes much clearer if you look at the Web Deploy error log in Event Viewer.
User: DEPLOYSERVER\User1
Client IP: 192.168.0.203 
Content-Type: application/msdeploy
Version: 8.0.0.0
MSDeploy.VersionMin: 7.1.600.0
MSDeploy.VersionMax: 7.1.1070.1
MSDeploy.Method: Sync
MSDeploy.RequestId: 63b2f3d1-1817-444f-8280-9fa4f6f85d53
MSDeploy.RequestCulture: en-US
MSDeploy.RequestUICulture: en-US
Skip: objectName="^configProtectedData$"
Provider: auto, Path:
Tracing deployment agent exception. Request ID '63b2f3d1-1817-444f-8280-9fa4f6f85d53'. Request Timestamp: '5/12/2011 9:31:41 AM'. Error Details:
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
at System.Security.AccessControl.Win32.SetSecurityInfo(ResourceType type, String name, SafeHandle handle, SecurityInfos securityInformation, SecurityIdentifier owner, SecurityIdentifier group, GenericAcl sacl, GenericAcl dacl)
at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, SafeHandle handle, AccessControlSections includeSections, Object exceptionContext)
at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, AccessControlSections includeSections, Object exceptionContext)
at Microsoft.Web.Deployment.FileSystemSecurityEx.Persist(String path)
at Microsoft.Web.Deployment.SetAclProvider.Add(DeploymentObject source, Boolean whatIf)
at Microsoft.Web.Deployment.DeploymentObject.Update(DeploymentObject source, DeploymentSyncContext syncContext)
at Microsoft.Web.Deployment.DeploymentSyncContext.HandleUpdate(DeploymentObject destObject, DeploymentObject sourceObject)
at Microsoft.Web.Deployment.DeploymentSyncContext.SyncChildrenOrder(DeploymentObject dest, DeploymentObject source)
at Microsoft.Web.Deployment.DeploymentSyncContext.ProcessSync(DeploymentObject destinationObject, DeploymentObject sourceObject)

To fix, they suggest the following:

From this, we can see that User1 does not have rights to set security information. In this case, the user does not have Modify permissions on the content. Granting "Change Permissions" to the content resolves the problem.

What is meant by 'Granting "Change Permissions"' ? I presumed they meant file permission so have given read/write/modify file permissions to the website directory structures but I still receive the error.

Stedfast

Found the problem basically I needed to give full control permission to LOCAL SERVICE. I had given the permision to IIS_USER. The following link gave me the solution forums.iis.net/t/1188531.aspx/1 – Stedfast

Woah! I hope you changed the permission on IIS_USER back to the recommended permission. Full user permissions on IIS_USER is a hacker's wet dream. – Curkell

as it says in the article you need to give FULL control, not just MODIFY permission to LOCAL SERVICE – Paddock

Web Deploy worked, then I deleted the site and remade it, then it didn't work, finally adding LOCAL SERVICE permission as mentioned above to the folder fixed it. I will never know why, but it worked. – Conveyor

Answer 1

To use Web Deploy, the deploy service need access right on your root web application folder. So what I did is to grant full access of my web site root folder to user group "Authenticated Users". And it works for me.

Quirt

Amazingly this is what worked for me, after hours of trying to fix – Feuilleton

You can also grant full control to "LOCAL SERVICE" or whatever identity the Web Management Service is running as. It's a bit annoying that you have to do this though. – Saxhorn