WMSVC works, Web Deploy Agent throws 401

3
votes

I'm trying to get msdeploy working from the command line, and can successfully test against the WMSVC directly (using HTTPS, port 8172) with both a local admin account and using an IIS Manager user account. Here's the command line:

> msdeploy -verb:dump -source:appHostConfig=MyWebsite,wmsvc=myserver,username=iisuser,password=password -allowuntrusted

So, wmsvc= directs msdeploy to use https://myserver:8172/msdeploy.axd . However, because the target host firewall doesn't allow port 8172, I'd really like to use the Web Deployment Agent Service over port 80. But, it responds with a 401 when I change wmsvc to computerName:

> msdeploy -verb:dump -source:appHostConfig=MyWebsite,computername=myserver,username=myserver\localadmin,password=password

where computername= directs msdeploy to use http://myserver/MSDEPLOYAGENTSERVICE . In a browser, that URL prompts for username/password, and returns a blank page (if authenticated), so it seems to be listening and authenticating properly. Also, I've added full rights to the site root for NETWORK SERVICE.

What's the difference in using the Web Deployment Agent Service over the standard WMSVC? Thanks in advance!

1
iiswebdeploy
I should add that I get no hits in any logs when hitting the Agent, even after enabling Failed Request tracing for 401s, but I see everything when hitting wmsvc directly. – jkoreska
WMSvc is the newer IIS 7 method that involves delegating permissions such that a user attempting to deploy need not have admin rights on the remote machine (which Web Deploy Agent requires). – Sean Hanley

1 Answers

2
votes

As far as I've discovered so far, the differences are:

  • WMSVC is tightly bound with IIS, whereas the remote agent appears not to be

  • WMSVC users can be windows or IIS users, and you can delegate permissions via the IIS manager so they can run some tasks under other security accounts etc. You can also control the paths that they are allowed to do things under.

  • Remote agent users can only execute tasks within the context of their own account on the machine: you control what they can do directly through the windows security mechanism.