My website .asp pages give a directory listing (or Directory Listing Denied)

Posted on 2010-08-31
Last Modified: 2012-05-10
Up until recently, my websites had been working properly for years.  Suddenly, two of the websites on the same server (Windows 2003 IIS 6) began to experience the same problem at the same time.  It is possible that I or a co-worker unintentionally changed a server setting to cause this problem.

I'll substitute my actual website domains with and

Whenever any visitor goes to or, they get a directory listing instead of the actual page.  The same is true with my other asp site,  This happens for every .asp page on both website.  .html pages work fine.  Also, we have some .NET websites on the server and their .aspx pages are working fine too.  Only .asp pages are giving directory listings.

From within the webserver, I have tried accessing the pages using a local internal (10.100...) IP address.  I still get a directory listing, so I can safely rule out the firewall as somehow being responsible.

There is one more unusual twist, which is that the sites will display a .asp page correctly as a default document.  In other words, if I go to then I will actually see index.asp displayed correctly (if index.asp is the default document) and the asp code runs properly!  But if I go to, I get a directory listing.

Thank you very much!
Question by:jessla13
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 3
  • 2
  • +2
LVL 31

Expert Comment

by:Wayne Barron
ID: 33571582
seen this happen before.
Here are some links, hopefully one will help you

Good Luck

Author Comment

ID: 33571961
None of the suggestions in the first link seem to describe my problem, but I decided to follow through anyway and I pursued the following:
-I tried resyncing the IWAM account by running the cscript synciwam.vbs command
-I made sure that Active Server Pages was set to Allow under Web Service Extensions (it was)
-I very briefly tried setting all extensions to Allow, but it still didn't work.  I changed the unknown extensions, internet data connecter, and webdav back to prohibit after trying this.

In the 2nd link, I followed the suggestion of adding permissions to the Internet Guest Account and to the Network Service account.  That didn't resolve the issue.  I then went a step forward and gave "Full Control" to the "Everyone" group as a way to completely rule out a permissions issue.  I still got Directory Listings when requesting .asp pages.

The 2nd link also suggested checking permissions on any files being referenced that were outside of the web directory (for example, DLL files elsewhere on the server).  In order to rule out this problem, I have been testing on a file I created called testpage.asp which does not reference any other files.  It merely contains the text "hello this is a test page" and nothing else.  Everyone has Full Control on this page.  Even this page gives me a directory listing.

To summarize, I feel that the first link was not applicable and that I have sufficiently exhausted the advice from the 2nd link.  Any other suggestions?

Author Comment

ID: 33571985
Oops, the last sentence of my previous post doesn't make sense.  I meant to say that the first link didn't seem applicable, but I followed the troubleshooting steps anyway.  I also followed the troubleshooting steps of the 2nd link, and haven't had luck with either.
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 31

Expert Comment

by:Wayne Barron
ID: 33572404
I had it when some works for one situation, but not for someone elses.
If I can think of anything else I will let you know.

A sure fire way to fix the issue (In nearly 99% of the cases)
A reinstall of IIS.

If you are on a production server, then this might be something that you want to check in on especially if you have sites that need to be online NOW...

Remember to do a backup of the sites before you do this.
Right click on computer name is IIS and choose
Tasks | Backup and Restore

That is the only thing that I can think of that I know almost always works.

Good Luck

Expert Comment

ID: 33573377
Directory Listing Denied error is generated when there is no Index file (default page) in the requested directory. For example, if a user types in their browser, and there is not an Index file in the requested directory, the user will receive the Directory Listing Denied error.
LVL 31

Expert Comment

by:Wayne Barron
ID: 33573463
you are correct shala
BUT, in this case, I doubt that he or the other tech deleted their default files from the directories.

Author Comment

ID: 33577326
shalabhsharma: We are not getting a directory listing denied error.  This is what is happening:

index.asp is the default document for the website. displays a directory listing displays a directory listing displays the default document, index.asp, correctly!
I hope you would agree that under no circumstances should a request for a specific page name (index.asp or someOtherPage.asp) result in a directory listing.  They should either display the page or give a 404 error, or some other error, but never a directory listing.
carrzkiss: I will try backing up my sites and reinstalling IIS tonight if I do not get any other suggestions.

Expert Comment

ID: 33577914
You may want to check the Custom Errors properties of your website.  It is possible to make a custom error show the directory listing of a folder if that custom error was set to show that instead.  Setting error message 404 to a URL that is allowed directory listing may list that directory instead of showing the actual 404 error message.

Also, depending on the settings of your website, "" may not be showing index.asp but rather default.asp, default.htm, index.htm, index.html, iisstart.asp.

So a possibility on what is happening here is that:

1. index.asp and someOtherPage.asp has an error and that custom page for that error was set to list the folder instead.

2. When accessing "", it is showing default.asp (or default.htm or index.htm or index.html) instead.

To correct this problem, check the Custom Errors page first if they are all correct (set to default if necessary). Then see if index.asp will show the actual error.

Hope this helps you find the problem.

Author Comment

ID: 33578887
Hello FEOX:  I appreciate your advice.  It makes a lot of sense given the information I have provided.

I will start right off by saying that I have just went into IIS, went to Custom Errors, and set all error messages to default.  It did not repair the problem or change any of my results.

Another thing I have tried in my testing is making a directory with a single file in it, like this:

There are no other files in testFolder.  The index.asp file in the testFolder contains no code at all.  Just plain text that says "This is a test index page". displays "This is a test index page" displays a directory listing

Therefore, the index.asp file in testFolder is working properly and is not generating an error message to bring about the directory listing.  Even so, I did set all custom errors to default as per your suggestion.  It did not work but at least we are ruling some things out.

Author Comment

ID: 33582838
I have just reinstalled IIS 6.0 completely and it did not resolve the problem.  Does anyone have any other advice?

Expert Comment

ID: 33583029
Another place to look is your Application Configuration: Mappings (Web Sites Properties: Home Directory: Configuration: Mappings).  What are the settings for ".asp"?  Mine is "C:\WINDOWS\system32\inetsrv\asp.dll".  Maybe some other DLL or EXE is processing your ".asp" files.
LVL 14

Expert Comment

ID: 33586381
I agree with FEOX you should check you Classic ASP script Mapping.

Right click on the website, then select properties.

Click the appropriate tab: Home Directory, Virtual Directory, or Directory

In the Application settings area, click Configuration, and then click the Mappings tab.

Scroll down until you find .asp and then check that you are seeing "C:\WINDOWS\system32\inetsrv\asp.dll" with the verbs GET,HEAD,POST,TRACE

see the following website for further info

Setting Application Mappings in IIS 6.0 (IIS 6.0)

If the .asp mapping is correct then you might want to check that someone has not added a wildcard mapping that is overriding everything.

On the Mappings tab check the box area marked Wildcards, under the mappings area to see if there are any wildcards set up.


Installing Wildcard Application Mappings (IIS 6.0)

Author Comment

ID: 33587484
Hello FEOX and wolfman007:

Thank you for the suggestion regarding Application Configuration mappings.  Unfortunately, my .asp is already mapped to C:\WINDOWS\system32\inetsrc\asp.dll with GET,HEAD,POST,TRACE

The wildcard box is empty.  Any other suggestions?

Author Comment

ID: 33587573
By the way, since all of my websites are affected (not just 1 website), I do not particularly expect to the find the answer under the IIS properties of a single website.

In addition to the 2 ASP websites that I already had, I have tried creating .asp pages in my other sites.  They also give the same problem, so this is really a server-wide issue and not limited to just 1 or 2 sites.

I have decided to reveal one such URL: will give you a DIrectory Listing Denied page.  If I was to allow directory listings on that site, you would actually see the directory listing instead.  The contents of something.asp is simply "this is a page"

Author Comment

ID: 33587629
Also note that your exact error message varies slightly by browser.  Internet Explorer 8 displays "The website declined to show this webpage" instead of "Directory Listing Denied".  Firefox will give you "Directory Listing Denied".  They mean the same thing in this case, although the IE8 message can mean other things in other situations.

Accepted Solution

jessla13 earned 0 total points
ID: 33618244
The issue was an ISAPI filter.  Even though the invidivual websites did not have any ISAPI filters, the parent "Web Sites" node (IIS6) can also contain ISAPI filters.  Clearing one of the filters and performing an IISRESET fixed the problem.

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Lync server 2013 or Skype for business Backup Service Error ID 4049 – After File Share Migration
When it comes to showing a 404 error page to your visitors, you do not want that generic page to show, and you especially do not want your hosting provider’s ad error page to show either. In this article, I will show you how to enable the custom 40…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below.…
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question