Folder Permissions for WorldMail 3 & Web Client (webmail)

ISSUE:

Logging into WorldMail Web Client (webmail) yields an error message similar to the following:

Server object error 'ASP 0177 : 800a0046'

Server.CreateObject Failed

/web/express.asp, line 8

The operation completed successfully

SOLUTION:

These are the suggested permissions to be set which will help in Securing WorldMail 3 and Web Client (webmail) on your server.

NOTE: If currently using an NT account assigned to the WorldMail service(s) it's recommend to rename this account to "MSIISUSR", which will save time during an upgrade process which the installer may update the permissions on all the WorldMail Directories.

The NT account you've assigned to the WorldMail Service(s) require the following access to the directories specified below:

WorldMail 3 Program Folder and all sub-directories:

Suggested account(s): Administrator(s) ; System ; MSIISUSR ; LOCAL_IUSR

Required Permissions: Read and Execute access

The WorldMail WebClient directory (if) located outside of the WorldMail folder requires the following:

Suggested account(s): Administrator(s) ; System ; MSIISUSR ; LOCAL_IUSR

Required Permissions: Read and Execute access

Under the WebClient "CACHE" & "TEMP" folders:

Required account(s): Administrator(s) ; System ; MSIISUSR ; IUSR_Local ; IWAM_USR_Local

Required Permissions: Full Access with the exception of (execute access)

NOTE: Disable "execute scripts for ALL accounts"

The WorldMail "SPOOL" and "BOX" directories:

Required account(s): Administrator(s) ; System ; MSIISUSR ; IUSR_Local ; IWAM_USR_Local

Required Permissions: FULL access

Next you will need to open IIS and get the Properties for the Web Client virtual share/web site and change the Directories security from the Anonymous user account to the NT account assigned to all of the WorldMail service(s).

If the current account is set to the: "MSIISUSR" switch to "LOCAL_IUSR"

Note:

If using a Domain NT user account, be sure to enter the password and do not check the box to allow IIS to control the password. This only works with local NT accounts, which the password will be pulled from the local registry.

Important Note:

While in IIS make sure under the General tab Web Client is configured to use HIGH (ISOLATED) memory protection.

*Securing WorldMail in this fashion enables you to specify a UNC path for the BOX and/or the SPOOL directories. This is important if using a Network Storage Appliance or remote share on a network file storage server.

After you have made these changes verify you can send and receive email. If you have not already removed the unnecessary NT accounts from the above mentioned directories it is recommend you do so now to help secure access to those resources and reduce the risk of a hacker breaking into your system or being vulnerable to unknown viruses.

More Information:

Below is information from the Release notes which talks about the Upgrade and Installation of WorldMail

MINOR UPGRADE INSTALLATION:

A Minor upgrade is an upgrade from a previous 3.x version. The upgrade process simply updates the files for features that are already installed. All permissions, settings and configuration settings will be left intact.

NEW INSTALLATION:

The New installation assumes that any previous version of WorldMail has been removed or the Operating system has been newly installed. The installation will configure WorldMail with the necessary accounts and permissions for the WorldMail directory and sub-directories.

KEYWORDS: 2663HQ,WM3,0177,800a0046,ASP,WEBMAIL,WEB CLIENT,PERMISSION,SECURITY