FIX: "ConfigurationException" Error Message When Impersonated Accounts Read Configuration

If your Web server is under high memory consumption, you may receive the following error message when you browse to ASP.NET pages: After you receive this error, any other users who access this application receive the error as well, even if they have sufficient permissions to read the configuration files.

When an application is activated, ASP.NET uses the process identity to read configuration data. The configuration data is then cached and reused across subsequent requests.

However, under high memory consumption, ASP.NET may discard configuration data from the cache, which forces it to be read again when it is needed. When this occurs, ASP.NET can use the impersonated identity rather than the process identity to read the configuration data.

This problem does not occur if impersonation is not used for a given application. In that scenario, only the account in which the process is configured to run needs Read access to the configuration files.

To work around this problem, ensure that the accounts under which you may run code have Read (R) access to the configuration files in the application hierarchy. After you apply the Read permissions, restart Microsoft Internet Information Server (IIS).

Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article. This bug was corrected in ASP.NET (included with the .NET Framework) 1.1.

The default configuration of ASP.NET does not allow configuration files to be accessed through the Web space, regardless of Access Control Lists (ACLs) on the configuration file.

For an overview on ASP.NET security, see the following Microsoft Knowledge Base article: