Troubleshooting IIS

Understanding HTTP Error Messages

HTTP error messages are related to the HTTP status codes which are included in the response headers when pages are requested from the Web server. HTTP status codes are three digit numbers.

HTTP status codes are categorized into the following categories:

• Informational (1xx): This category is used for testing, and is not used for production Web servers.
• Successful (2xx): Indicates that requests were successfully received.
• Redirection (3xx): Indicates that the client needs to perform additional steps for his/her request to be serviced.
• Client Error (4xx): Indicates an error at the client.
• Server Error (5xx): Indicates an error at the server.

Understanding HTTP error messages and their associated status codes is important when you need to troubleshoot IIS. A few common errors on the client side (4xx error) and server side (5xx error) are listed below:

• 400 Bad Request; the server cannot service the request, usually because of an incorrect URL.
• 401 Unauthorized; the users credentials were not accepted by the authorization process.
• 403 Forbidden; the request could not be serviced for a number of reasons, even though the user was authenticated.
• 404 Not Found; the server cannot locate the requested file.
• 405 Method Not Allowed; the client incorrectly issues a HTTP GET request when a HTTP POST request should have been issued.
• 406 Not Acceptable; the requested file is not supported by the client.
• 407 Proxy Authentication Required; the client has to authenticate with the proxy server before its request can be serviced.
• 410 Gone; the server no longer has the requested file.
• 500 Internal Server Error; indicates a typical server side error.
• 501 Not Implemented; the server does not support the HTTP method requested by the client.
• 502 Bad Gateway; an invalid response was received by the upstream server for which this server is a gateway.
• 503 Service Unavailable; the server does not support the service requested by the client.

From the above, you can see that a few of the error codes are quite vague in describing the actual issue. For this reason, a few HTTP error messages have substatus codes to provide more information on the current errors. The substatus codes associated with the various HTTP error messages in IIS 6 are:

• The substatus codes for the 401 Unauthorized status code are:
  • 1; logon failed
  • 2; logon failed because of the server configuration
  • 3; logon failed because of the ACL on resource
  • 4; logon failed due to filter
  • 5; logon failed due to ISAPI/CGI application
  • 7; logon failed due to URL Authorization policy
• The substatus codes for the 403 Forbidden status code are:
  • 1; Execute access denied
  • 2; Read access denied
  • 3; Write access denied
  • 4; requires SSL
  • 5; requires SSL 128-bit
  • 6; IP address denied
  • 7; requires client certificate
  • 8; site access rejected
  • 9; users too much
  • 10; invalid configuration
  • 11; password modified
  • 12; mapper access rejected
  • 13; client certificate revoked
  • 14; directory listing rejected
  • 15; client Access License exceeded
  • 16; client certificate not trusted
  • 17; client certificate either not valid yet, or expired
  • 18; request cannot be serviced by particular application pool
  • 19; CGI access rejected
  • 20; Passport failed
• The substatus codes for the 404 Not Found status code are:
  • 2; denied by Lockdown Policy
  • 3; denied by MIME Map Policy
• The substatus codes for the 500 Internal Serve Error status code are:
  • 12; application restarting
  • 13; server occupied
  • 15; direct requests forbidden for GLOBAL.ASA
  • 16; UNC access error
  • 17; URL Authorization store not located
  • 18; URL Authorization store cannot be accessed/opened
  • 19; bad file in metabase
  • 100; ASP application error

By default, IIS returns the following default HTTP errors:

• 403; 14 Forbidden – directory listing rejected
• 500 Internal Server Error
• 500; 100 Internal Server Error – ASP error
• 501 Not Implemented
• 502 Bad Gateway

Custom HTTP Error Messages

Besides for the default HTTP error messages, IIS returns custom error messages. IIS returns custom error messages for all the other HTTP error messages, other than the default HTTP error messages listed previously. Custom error messages provide more information on the error condition than what the default messages provide, and can be customized. The custom error messages also include additional troubleshooting tips, which the default HTTP error messages do not provide. When custom error messages are enabled, IIS logs the error in the web logs for the site at the same time that it sends the HTTP error message to the client.

You can however configure IIS to return a default message over a custom error message for a particular error, or you can configure IIS to return only default error messages for all errors.

The details and troubleshooting tips associated with custom HTTP error messages are discussed and condensed in the following section:

• The Page Cannot Be Displayed: The page which you are looking for is currently unavailable.
  Please try the following:
  • Click the Refresh button.
  • Click the Back button to attempt a different link.
  • Ensure that the website page address is spelt correctly.
  • Verify the network connection settings which are being used. To do this, click the Tools menu, click Internet Options, and then click the Connections tab. Click Settings. The settings detailed for the connections must correspond to the settings which were provided by the ISP or LAN administrator.
  • To enable Windows to automatically detect your network connection settings, click Detect Network Settings.
  • Sites may require 128-bit SSL connection security. Use Help | About Internet Explorer to verify that the correct connection security is supported, and can be utilized.
  • Verify that your existing Security settings can support the required connection security by clicking the Tools menu, clicking Internet Options, and clicking the Advanced tab. Verify the settings for SSL 2.0, SSL 3.0, TLS 1.0, and PCT 1.0.

  Additional troubleshooting tips:

  • The client has incorrectly spelt the domain name of the website in the requested URL.
  • The port number of the website has since changed from its standard setting of port 80 to a different port number.
  • The website may have been stopped or paused by the administrator.
• 400 Bad Request: The page could be temporarily unavailable, could have been removed, could have undergone a name change, or could have its content expired.
  Please try the following:
  • Ensure that the website address is spelt correctly.
  • Click the Back button to attempt a different link to access the same content.
  • Contact an administrator to inform him/her that the link is incorrectly formatted.

  Additional troubleshooting tips:

  • The client is normally the cause of this error condition. Typical causes are the utilization of spaces in the URL, or a syntax error in the URL.
  • The Default Web Site could have had its IP address changed from All Unassigned to an IP address which is not specified on IP Settings tab of the Advanced TCP/IP properties window.
• 401 You Are Not Authorized to View This Page: The credentials which were provided do not include permission to access the page or directory.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.

  Additional troubleshooting tips:

  • The provided credentials do not exist for the user.
  • A mapping failure occurred between the .NET Passports and the user accounts stored in Active Directory.
• 401.2 You Are Not Authorized to View This Page: The credentials which were provided do not include permission to access the page or directory because the Web browser is sending a WWW-Authenticate header field which is not supported by the Web server.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.

  Additional troubleshooting tips:

  • The site contains no configured authentication methods.
  • The incorrect credentials are being used to access a remote virtual directory.
• 401.3 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the page or directory because of the ACL set on the resource on the Web server.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.

  Additional troubleshooting tips:

  • NTFS permissions are incorrectly configured for the requested file.
• 401.4 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because user authentication failed. This is due to a filter implemented on the Web server which authenticates user access, and authentication has failed.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
• 401.5 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because authentication failed due to an ISAPI application or a CGI application.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
• 401.6 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because the authorization scope associated with the URL could not be located on the Web server.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
• 401.7 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory because of the URL Authorization policy configured for the Web server.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credential.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
• 403 You Are Not Authorized to View This Page: The credentials which were provided cannot be used to access the requested page or directory.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
• 403.1 The Page Cannot Be Displayed: An executable program (CGI, ISAPI or some other program) was executed from a directory from which it could not be executed.
  Please try the following:
  • Contact an administrator to determine whether or not you should be allowed to execute programs from the directory.

  Additional troubleshooting tips:

  • Open the Home Directory tab of the website to check what execute permissions has been configured. For CGI and ISAPI applications, check that Script and Executable permissions have been configured.
• 403.2 The Page Cannot Be Displayed: The page attempting to be accessed cannot be displayed. This is normally due to the directory being configured to allow Script and Execute permissions only.
  Please try the following:
  • Contact an administrator to determine whether Read permission should be allowed.

  Additional troubleshooting tips:

  • Open the Home Directory tab of the website to check whether the Read permission has been configured.
• 403.3 The Page Cannot Be Saved: The page cannot be saved to the website because Write access is not allowed.
  Please try the following:
  • Contact an administrator to determine whether Write permission should be allowed for the directory.

  Additional troubleshooting tips:

  • For publishing content to IIS using either WebDAV or FrontPage, verify that the correct permission has been configured for the website.
  • For FTP sites, verify that the Write permission is enabled.
• 403.4 The Page Must Be Viewed Over A Secure Channel: The page requires a Secure Sockets Layer (SSL) connection.
  Please try the following:
  • Enter https:// at the start of the address you want to navigate to.
• 403.5 The Page Must Be Viewed With a High-Security Web Browser: To access the resource, your web browser needs to support 128-bit Secure Sockets Layer (SSL) encryption.
  Please try the following:
  • Upgrade the web browser to support 128-bit SSL encryption.
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
• 403.6 You Are Not Authorized to View This Page: The website has a predefined list of denied IP addresses, and the IP address being utilized appears on that list.
  Please try the following:
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.

  Additional troubleshooting tips:

  • Open the Directory Security tab of the website, and check whether the IP address appears on the IP Address and Domain Name Restrictions list.
• 403.7 The Page Requires a Client Certificate: To access the page, you need a web browser to have a Secure Sockets Layer (SSL) client certificate which the particular Web server accepts.
  Please try the following:
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.
  • Contact an administrator to obtain a client certificate.
  • If you have a client certificate (valid) verify that is installed correctly.
• 403.8 You Are Not Authorized to View This Page The Web server has a predefined list of denied DNS names, and the DNS name being utilized appears on that list.
  Please try the following:
  • Contact an administrator to inform him/her that you should be allowed to access the page/directory.

  Additional troubleshooting tips:

  • Open the Directory Security tab of the website, and check whether the DNS domain name of the client is disallowed.
• 403.9 The Page Cannot Be Displayed: The Web server is currently too occupied to service the request.
  Please try the following:
  • Click the Refresh button

  Additional troubleshooting tips:

  • Verify whether the Connection Limit for the Web server has been surpassed.
• 403.10 You Are Not Authorized to View This Page: This directory does not allow executable programs to be executed.
  Please try the following:
  • Contact an administrator to determine whether or not the directory should be configured to allow execute access.
• 403.11 You Are Not Authorized To View This Page: The credentials provided to access the page/directory does not have the necessary permissions.
  Please try the following:
  • Click the Refresh button and attempt to access the page/directory by providing different credentials.
  • Contact an administrator to inform him/her that you should be allowed to view the page/directory.
• 403.12 The Requested Page Requires A Valid SSL Client Certificate: The account associated with the client certificate on the Web server has not been allowed access to the site.
  Please try the following:
  • Contact an administrator to determine what the client certificate permissions are.
  • If you have a client certificate (valid) verify that is installed correctly.
  • Change the client certificate, click the Refresh button.
• 403.13 The Page Requires A Valid SSL Client Certificate: The client certificate which was used has been revoked.
  Please try the following:
  • Contact an administrator to determine what the client certificate permissions are.
  • Contact an administrator to obtain a client certificate.
• 403.14 Directory Listing Is Denied: A directory listing of this directory’s content is not configured on the Web server.
  Please try the following:
  • Contact an administrator to determine whether a directory listing should be allowed.

  Additional troubleshooting tips:

  • Verify whether the Directory Browsing setting, and the Read permission has been enabled on the Home Directory tab for the site.
• 403.15 The Page Cannot Be Displayed: The Web server has surpassed the configured Client Access License limit.
  Please try the following:
  • Click the Refresh button.
• 403.16 The Page Requires A Valid SSL Client Certificate: The current client certificate is invalid/untrusted.
  Please try the following:
  • Contact an administrator to determine what the client certificate permissions are.
  • Verify that your existing valid client certificate is installed correctly.
  • Contact an administrator to obtain a client certificate.
• 403.17 The Page Requires A Valid SSL Client Certificate: The current client certificate is invalid or has expired. A SSL client certificate is used to verify access to this particular resource.
  Please try the following:
  • Contact an administrator to determine what the client certificate permissions are.
  • Verify that your existing valid client certificate is installed correctly.
  • Change the client certificate, click Refresh.
• 403.18 Cannot Execute Request from the Current Application Pool: The request could not be executed from the Current Application Pool specified for the particular resource.
  Please try the following:
  • Contact an administrator to inform him/her that you should be allowed to view the page/directory.
• 403.19 Cannot Execute CGI Applications in the Current Application Pool on the Web Server: CGI Applications could not be executed from the Current Application Pool because the user has insufficient permissions.
  Please try the following:
  • Contact an administrator to inform him/her that you should be allowed to execute CGI applications.
• 403.20 Passport Login Failed: An error was received from the Passport logon server.
  Please try the following:
  • Contact an administrator to inform him/her that you should be allowed to view the page/directory.
  • Click the Refresh button.
• 404 The Page Cannot Be Found: The page was either renamed, removed, or is currently unavailable.
  Please try the following:
  • Ensure that the website address is correctly spelt and formatted.
  • Click the Back button to attempt a different link to access the same page.
  • Contact an administrator to inform him/her that the link is incorrectly formatted.
• 404.1 The Website Cannot Be Found: For this site, an IP address is specified to disallow requests which detail a port number.
  Please try the following:
  • Ensure that the website address is correctly spelt and formatted.
  • Click the Back button to attempt a different link to access the same page.
  • Contact an administrator to inform him/her that the link is incorrectly formatted.

  Additional troubleshooting tips:

  • The client is probably requesting a URL for an IP address that is not used by IIS.
• 404.2 The Page Cannot Be Found: The web service extensions specified for the Web server is preventing the request from being serviced.
  Please try the following:
  • Contact an administrator to inform him/her that the required web service extension is not configured for the site.

  Additional troubleshooting tips:

  • The required web service extension for the ASP.NET, ASP, ISAPI, or CGI application has not been configured.
  • An application extension is not mapped in IIS.
  • The user account under which the application (CGI) executes has the incorrect permissions.
• 404.3 The Page Cannot Be Found: The Multipurpose Internet Mail Extensions (MIME) map policy specified for the Web server is preventing the request from being serviced.
  Please try the following:
  • Contact an administrator to inform him/her that the required file extensions have not been enabled via the MIME map policy.

  Additional troubleshooting tips:

  • The request is for a static file that’s filename extension is not specified in the MIME map for the Web server or website.
• 405 The Page Cannot Be Displayed: An invalid method, such as a HTTP verb, was used in the request for the page.
  Please try the following:
  • Ensure that the website address is correctly spelt and formatted.
  • Contact an administrator to inform him/her that the request should be allowed.
• 406 The Resource Cannot Be Displayed: The requested page has a filename extension that is not supported by the browser being used.
  Please try the following:
  • Modify the MIME/security settings of the browser to support the requested page’s filename extension.
• 407 Proxy Authentication Required: To view the requested page, authentication has to occur through a proxy server.
  Please try the following:
  • Contact the administrator if you should be allowed to view the page/directory.
  • Retry logging on to the proxy server.
• 410 The Page Does Not Exist: The requested page has since been removed/deleted.
  Please try the following:
  • Find additional links to the information which you want to view.
• 412 The Page Cannot Be Displayed: The request could not be serviced because of preconditions existing in the request header which are preventing the particular request method.
  Please try the following:
  • Find additional links to the information which you want to view.
  • Delete any cached items and click Refresh.
• 414 The Page Cannot Be Displayed: The requested URL address length is too long.
  Please try the following:
  • Ensure that the website address is correctly spelt and formatted.
  • Contact the administrator to inform him/her of the URL address error.
• 415 The Page Cannot Be Returned: The requested file has a format which the Web server cannot download.
  Please try the following:
  • Contact the administrator to inform him/her of the error for the requested file.
• 500 The Page Cannot Be Displayed: The requested page has a problematic condition which is preventing the request from being serviced.
  Please try the following:
  • Contact the administrator to inform him/her of the URL address error condition.
• 500.11 The Page Cannot Be Displayed: The particular website is in the process of shutting down.
  Please try the following:
  • Click the Refresh button.
  • Contact the administrator to inform him/her of the URL address error condition if you continuously cannot access the website.
• 500.12 The Page Cannot Be Displayed: The particular website is in the process of restarting.
  Please try the following:
  • Click the Refresh button.
  • Contact the administrator to inform him/her of the URL address error condition if you continuously cannot access the website.
• 500.13 The Page Cannot Be Displayed: The particular website is too busy to service the request