October 19, 2010

CDO.Message.1 error 80070005 Access is Denied

Posted in ASP, How-to, IIS at 10:46 pm by Ben

Okay, clearly we’re talking about some outdated stuff here, but we all have to work on outdated stuff sometimes, right?  I ran across this error trying to send mail from an ASP page using the CDO.Message object, and pretty much every Google result about how to fix it (forum posts all, not official answers) was wrong in one way or another.  The information below is for Windows 2003 running IIS6, including (and this is important) Small Business Server.

One answer I saw was to give IUSR write permission on C:\inetpub\mailroot\pickup, which is close (though less so if you’re running SBS or any other machine which doubles as an Exchange server).  Another, which did work for me, but I’d be damned if I was going to obliterate my security that way, was to change the website’s app pool from DefaultAppPool to ExchangeApplicationPool.  No, I won’t run my public-facing web site under an application pool that runs as Local System, thanks!

The answer was to set permissions on the mail pickup directory - though IUSR is not necessarily the account that needs the permission - and if you’re running SBS (or Exchange generally), it’s not going to be at the above location, it’s going to be at %Program Files%\Exchsrvr\Mailroot\vsi 1\PickUp.  The user who needs permission is not the account set for the site (often IUSR, though if you’re using security, it may be the logged-in user), but the account for the app pool’s identity - in my case Network Service.  This is why changing the site’s app pool to one running as Local System (that is to say, one with complete access to absolutely everything) worked, but isn’t actually something you’d want to do.

Permalink