The ASPEnableParentPaths Property Is Not Disabled on the Default Web Site or the IIS Administration Site in Small Business Server 2000 SP1 (327985)


The information in this article applies to:

  • Microsoft Small Business Server 2000 SP1
This article was previously published under Q327985
IMPORTANT: This article contains information about editing the metabase. Before you edit the metabase, verify that you have a backup copy that you can restore if a problem occurs. For information about how to do this, see the "Configuration Backup/Restore" Help topic in Microsoft Management Console (MMC).

SYMPTOMS

After you install Microsoft Small Business Server (SBS) 2000 Service Pack 1 (SP1), the metabase settings for the ASPEnableParentPaths property are not changed to FALSE for the default Web site and the Internet Information Services (IIS) Administration Web site if either of the Web sites is the third Web site (w3svc/3) or higher. You do not receive warnings or error messages.

This behavior occurs on installations of SBS 2000 SP1 where either the default Web site or the Administration Web site has been moved from the default locations of w3svc/1 and w3svc/2. For example:
  • w3svc/1 - Default Web site
  • w3svc/2 - User Web site
  • w3svc/3 - IIS Administration Web site

CAUSE

During the SBS 2000 SP1 installation, only the following metabase locations are changed:
  • w3svc/
  • w3svc/1/root
  • w3svc/1/root/iishelp
  • w3svc/1/root/iisadmin
  • w3svc/2/root
  • w3svc/2/root/iishelp
  • w3svc/2/root/iisadmin

WORKAROUND

To work around this behavior, you can change the target value of the ASPEnableParentPaths property to FALSE by editing the properties of the Web site or by editing the metabase manually.

Edit the Setting on the Web Site Properties

  1. Click Start, click Programs, click Administrative Tools, and then click Internet Services Manager to open IIS Microsoft Management Console (MMC).
  2. Expand the server.

    NOTE: Make sure that the view on the right pane is set to Normal.
  3. Right-click the selected Web site, and then click Properties.
  4. If the Web site you want to change is a root site, such as the default Web site, click the Home Directory tab.

    NOTE: The child Web site Properties dialog box is the same as the Home Directory tab in the root Web properties.
  5. Click the Configuration button, click the App Options tab, and then click to clear the Enable Parent Paths check box.
  6. Click OK, and then click OK again to save the settings and to return to Internet Services Manager MMC.

Manually Edit the Setting By Using Adsutil.vbs to Modify the Metabase

WARNING: If you edit the metabase incorrectly, you can cause serious problems that may require you to reinstall any product that uses the metabase. Microsoft cannot guarantee that problems that result if you incorrectly edit the metabase can be solved. Edit the metabase at your own risk.

NOTE: Always back up the metabase before you edit it.

Adsutil.vbs is located in the C:\Inetpub\AdminScripts folder. To use Adsutil.vbs, use the following command-line syntax:

cscript.exe c:\inetpub\adminscripts\adsutil.vbs set path "FALSE"

In this command, path is one of the following paths, where number is the Web site number:
  • /w3svc/number/root/AspEnableParentPaths
  • /w3svc/number/root/iisadmin/AspEnableParentPaths
  • /w3svc/number/root/iishelp/AspEnableParentPaths

STATUS

This behavior is by design.

MORE INFORMATION

The AspEnableParentPaths property in the metabase specifies whether an Active Server Pages (ASP) page can allow paths relative to the current directory (using the "...\" notation). This may be a security risk. In a secure environment, set the AspEnableParentPaths property to FALSE.

REFERENCES

184717 AspEnableParentPaths MetaBase Property Should Be Set To False

Modification Type:MajorLast Reviewed:6/13/2003
Keywords:kbbug kbnofix KB327985
©2002 Microsoft Corporation. All rights reserved.