尝试使用 powershell 保护站点时出现 403：禁止访问被拒绝错误
我正在 powershell 中编写一个脚本来锁定云环境网站应用程序。我已经安装了 SSL，在 AD 中创建了组/用户，禁用了用户，禁用了应用程序池，并创建了应用程序池来总结脚本。赢得 2008 r2/iis7。测试站点时，我收到“403 Forbidden：访问被拒绝” 当我检查系统日志时，我看到以下三条消息：
级别：错误
源：WAS
事件 ID：5059
应用程序池 RiskChecker 已被禁用。 Windows 进程激活服务 (WAS) 在启动工作进程来为应用程序池提供服务时遇到故障。
级别：警告
来源：WAS
事件 ID：5057
应用程序池 RiskChecker 已被禁用。 Windows Process Activation Service (WAS) 未创建工作进程来为应用程序池提供服务，因为应用程序池标识无效。
级别：警告
来源：WAS
事件 ID：5021
应用程序池 XYZAppPool 的标识无效。为身份指定的用户名或密码可能不正确，或者用户可能没有批量登录权限。如果身份不正确，当应用程序池收到第一个请求时，应用程序池将被禁用。如果批量登录权限导致问题，则必须在授予权限后更改 IIS 配置存储中的标识，然后 Windows Process Activation Service (WAS) 才能重试登录。如果在处理第一个应用程序池请求后身份仍然无效，则应用程序池将被禁用。数据字段包含错误号。
这些消息意味着什么，有人可以指出我如何解决这个问题吗？谢谢。
I'm writing a script in powershell to lockdown a cloud environment website application. I have installed SSL, created groups/users in AD, disabled users, disabled app pools and and created app pools to summarize the script. Win 2008 r2 / iis7. When testing the site, I am getting a "403 Forbidden: Access is denied" When I check the system logs, I see the following three messages:
Level: Error
Source: WAS
Event ID: 5059
Application pool RiskChecker has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool.
Level: Warning
Source: WAS
Event ID: 5057
Application pool RiskChecker has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid.
Level: Warning
Source: WAS
Event ID: 5021
The identity of application pool XYZAppPool is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.
What do these messages mean, and can anyone point me in the direction of how to resolve this? Thank you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
正如 monojlds 所说，这是一个凭据问题 - 该错误意味着您为应用程序池输入的凭据不正确或不在正确的组中。
是本地用户还是域用户？也许该框无法针对正在使用的域进行身份验证？帐户会被锁定吗？ （最后一个曾经让我印象深刻）
在 IIS 服务器上，您可以在命令提示符下使用
runas测试凭据。它会要求您输入密码，然后启动另一个 cmd 或提供错误消息。这将有助于解决用户凭据问题。
马特
as monojlds says it's a credential issue - the error means the credentials you have entered for the app pool are incorrect or not in the right group.
is it a local user or a domain user? maybe the box can't authenticate against the domain being used? could the account be locked out? (that last one used to get me a lot)
on the IIS server you can test the credentials using
runason the command prompt.it'll ask for you password and either launch another cmd or provide an error message. That'll help troubleshoot the user credentials.
Matt
我建议您阅读此处：http://technet。 microsoft.com/en-us/library/cc735179(WS.10).aspx
强调下面引用的行：
I would recommend you to read here: http://technet.microsoft.com/en-us/library/cc735179(WS.10).aspx
Emphasis on the line quoted below: