FastCGI error - Access is denied

Question

_{Tuesday, September 22, 2009 4:00 PM}

 Hi,

I setup a web server with the following installed:

IIS 6.0
php-5.2.11-nts-Win32
FastCGI for IIS 6.0

I'm trying to use FastCGI to parse php scripts within my html files. But I first need for it to be able to parse php files. So when i tried viewing my index.php (or any other .php page) I get the following error:

FastCGI Error
The FastCGI Handler was unable to process the request.

Error Details:
    * Error Number: 5 (0x80070005).
    * Error Description: Access is denied.
HTTP Error 500 - Server Error.
Internet Information Services (IIS)

This is how i have my other configurations set up:

Environment Variables:
Path: C:\PHP;
PHPRC: C:\PHP

php.ini:
log_errors = On
error_log ="C:\PHP\logs\php-errors.log"
doc_root = "C:\Inetpub\wwwroot"
cgi.force_redirect = 0
cgi.fix_pathinfo=1
fastcgi.impersonate = 1;

fcgiext.ini:
[Types]
php=PHP

[PHP]
ExePath=C:\PHP\php-cgi.exe
InstanceMaxRequests=10000
EnvironmentVars=PHP_FCGI_MAX_REQUESTS:10000

IIS Manager:
(Under Web Sites > Home Directory > Configuration > Mappings)
  .php ==> C:\WINDOWS\system32\inetsrv\fcgiext.dll
  Limit to ==> GET,HEAD,POST
  Script engine = checked
  Verify that file exists = checked

(Under Web Service Extensions)
  FastCGI Handler = Allowed (C:\WINDOWS\system32\inetsrv\fcgiext.dll)
  PHP-FastCGI = Allowed (C:\PHP\php-cgi.exe) 

Can someone help me figure out my problem? Just to let you know, i can view html pages just fine. It's the .php pages that are giving me the error. Any help would be GREATLY appreciated!

Thanks,
Steve

All replies (9)

_{Wednesday, September 23, 2009 2:24 PM ✅Answered}

Looks like worker process identity doesn't have read, execute permissions to php-cgi.exe and is not able to launch it. You should change ACLs of PHP install folder to grant read, execute permissions to IUSR_<servername> account and IIS_WPG group. That should fix the problem.

Thanks,
Kanwal

_{Wednesday, September 23, 2009 4:20 PM ✅Answered}

There can be multiple reasons for that. Follow this blog http://blogs.iis.net/rickjames/archive/2007/10/16/fastcgi-debugging-quot-the-fastcgi-process-exited-unexpectedly-quot.aspx.

Thanks,

Don.

_{Tuesday, September 22, 2009 6:10 PM}

It seems IIS is not able to read some file. You can use Process Monitor to see which file IIS is not able to read and then fix the proble. Process Monitor can be downloaded from http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx.

Also check if http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx helps.

Thanks,

Don.

_{Wednesday, September 23, 2009 12:17 PM}

Hi Don,

I downloaded Process Monitor. I'm using it as we speak. Seeing that I've never used this before, it's not quite that simple to use. However, I did find something interesting. Take a look at some of the events it capture: 

12:03:16.5018105 PM iexplore.exe 2476 RegOpenKey HKLM\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation NAME NOT FOUND 

12:03:16.5018418 PM iexplore.exe 2476 RegQueryValue HKCU\Software\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode SUCCESS Type: REG_DWORD, Length: 4, Data: 1

12:03:16.5019448 PM iexplore.exe 804 RegOpenKey HKLM\Software\Microsoft\Rpc\SecurityService SUCCESS 

12:03:16.5019675 PM iexplore.exe 804 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel NAME NOT FOUND Length: 144

12:03:16.5019792 PM iexplore.exe 804 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc\SecurityService SUCCESS 

12:03:16.5023550 PM iexplore.exe 804 RegOpenKey HKLM\Software\Microsoft\Rpc\SecurityService SUCCESS 

12:03:16.5023784 PM iexplore.exe 804 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel NAME NOT FOUND Length: 144

12:03:16.5023902 PM iexplore.exe 804 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc\SecurityService SUCCESS 

12:03:16.5029944 PM iexplore.exe 804 RegOpenKey HKLM\Software\Microsoft\Rpc\SecurityService SUCCESS 

12:03:16.5030193 PM iexplore.exe 804 RegQueryValue HKLM\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel NAME NOT FOUND Length: 144

12:03:16.5030313 PM iexplore.exe 804 RegCloseKey HKLM\SOFTWARE\Microsoft\Rpc\SecurityService SUCCESS 

12:03:16.5031693 PM iexplore.exe 2476 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial NAME NOT FOUND Length: 144

12:03:16.5031981 PM iexplore.exe 2476 RegQueryKey HKCU\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness SUCCESS Query: Cached, SubKeys: 0, Values: 0

12:03:16.5038085 PM svchost.exe 2152 TCP Receive MEDCALDER01.ad.med.miami.edu:3389 -> 10.78.3.163:1432 SUCCESS Length: 17, connid: 2168463560, seqnum: 0

12:03:16.5042097 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a

12:03:16.5043773 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Random Access, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a

12:03:16.5045963 PM w3wp.exe 2808 CreateFile **C:\PHP\php-cgi.exe ACCESS DENIED **Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a

12:03:16.5047318 PM w3wp.exe 2808 CreateFile C:\PHP\php-cgi.exe ACCESS DENIED Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Complete If Oplocked, Random Access, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a

12:03:16.5048564 PM w3wp.exe 2808 RegOpenKey HKU\S-1-5-21-657493299-2567265176-880810032-1003 NAME NOT FOUND 

12:03:16.5048712 PM w3wp.exe 2808 RegOpenKey HKU\Default SUCCESS 

12:03:16.5048941 PM w3wp.exe 2808 RegOpenKey HKU\DEFAULT\Software\Policies\Microsoft\Control Panel\Desktop NAME NOT FOUND 
 

What do you think of this? Could it be the php-cgi.exe file? What kind of permission should it be given?? Or is there something else that I'm missing? Please let me know. Thanks.

-Steve

_{Wednesday, September 23, 2009 12:59 PM}

Yes, seems like this file is the culprit. Can you see what are the permissions on this file and let me know? I am not sure how did you entered this state. Also where from you installed PHP?

Thanks,

Don.

_{Wednesday, September 23, 2009 2:10 PM}

Hi Don,

The permissions that's listed on the php-cgi.exe file are:
-Administrators <-- FULL CONTROL
-Me (my username to log into the PC) <--FULL CONTROL
-SYSTEM <--FULL CONTROL

What do you mean "where from you installed PHP"? I downloaded it from: http://www.php.net/downloads.php

I downloaded the PHP 5.2.11 Non-thread-safe zip package. Then extracted it to my C:\PHP folder. I'm sorry, I don't know if this is what you were referring to. If not, please further explain.

Thanks,
Steve

_{Wednesday, September 23, 2009 2:20 PM}

Yes that was what I was asking. From Process Monitor please figure out which service/user is getting access denied and ensure that the service/user has appropriate permission to run the php-cgi.exe.

It also appears that you have configured FastCGI manually. In future please try out Web Platform Installer. Just select PHP from the list of platform and install. WEBPI will figure out all the dependencies (like if FastCGI is not installed it will pull that for you) and configure FastCGI automatically. So you will save a lot of time doing things manually.

Thanks,

Don.

_{Wednesday, September 23, 2009 2:50 PM}

Hi Kanwal,

Thank you for the info. I just changed the ACL of the PHP folder (C:\PHP). I added both the IUSR_<servername> acct and IIS_WPG group acct. It's set to Read & Execute. But I just noticed that it didn't replicate the permissions to the php-cgi.exe file. So I changed the ACL on the php-cgi file to allow the permissions to be inherited by its parent object, which in this case is the PHP folder. It now shows both accounts (IUSR_<servername> acct and IIS_WPG group acct) with Read and Execute permissions.

I restarted IIS, deleted my cache (temp internet files), and tried loading my site with the index.php page. I got a new error message. Here's the message I got:

FastCGI Error
The FastCGI Handler was unable to process the request.

Error Details:
•The FastCGI process exited unexpectedly
•Error Number: -2147467259 (0x80004005).
•Error Description: Unspecified error
HTTP Error 500 - Server Error.
Internet Information Services (IIS)

Can you tell me what this means or how I can go about fixing this?

Thanks.

-Steve

_{Friday, February 4, 2011 11:31 PM}

I solve this problem

I am do it:

1.go to php folder and right click on php-cgi.exe

2.go to properties and next security tab

3.in advanced you must checked "Allow inheritable permission from...." (this inherits from parent folder)

4.click ok 

now every thing is ok...but it isn't work...this when happened your permission for php folder (for example:c:\php) have problem...you must set permission for administrator and administrators and system and Server operation as full