How to Use Procmon Logs to Troubleshoot IIS Errors

When troubleshooting issues with Internet Information Services (IIS), it's essential to have the right tools and techniques at your disposal. One such tool is Process Monitor, which can provide valuable insights into what's happening behind the scenes. In this article, we'll explore how to use Procmon logs to troubleshoot IIS errors, specifically focusing on HTTP Error 401.3 - Unauthorized: Access is denied due to an ACL set on the requested resource.

Capturing a Process Monitor Log

To start troubleshooting, you'll need to capture a Process Monitor log while reproducing the issue. This will give you a detailed view of what's happening when the error occurs. You can also check the IIS logs and look at the sc-status and sc-substatus fields to see 401 and 3 respectively.

Unchecking Friendly Error Messages

It's good practice to leave the option to show friendly HTTP error messages unchecked when troubleshooting an issue that involves an error message in the browser. This is because you'll be more likely to get a full detailed error message, which can help you pinpoint the problem.

Unchecking Show Friendly HTTP Error Messages

Additionally, you may need to uncheck 'Show friendly HTTP error messages' in Internet Explorer on the Advanced tab under Tools/Internet Options as shown below to see this exact error.

Troubleshooting HTTP Error 401.3

The issue I faced was when browsing ASP pages, we were getting an error message in the browser that read: 'HTTP Error 401.3 - Unauthorized: Access is denied due to an ACL set on the requested resource.' To continue troubleshooting this issue, I ran across another problem recently where Process Monitor was again very helpful.

Using Procmon Logs for Troubleshooting

Last week, I posted a blog about how to use Process Monitor to troubleshoot service startup issues. This tool can be incredibly useful when dealing with errors like HTTP Error 401.3. By analyzing the log files, you can identify potential issues and take steps to resolve them.

In conclusion, using Procmon logs is an essential step in troubleshooting IIS errors, particularly when faced with a complex issue like HTTP Error 401.3. By following these steps and leveraging this powerful tool, you'll be well on your way to resolving even the most stubborn of problems.