Consider a scenario where you receive the following error when you browse to a SharePoint web app

The website declined to show this webpage
HTTP 403 
Most likely causes:
This website requires you to log in.

This issue is intermittent. Strangely, if we create a copy of the web.config file, rename the web.config file, refresh the home page, we receive an "HTTP 404 - Page Not Found" error. Rename the web.config file back and refresh the page. The site is browse able for a while before failing after some time

We see the following error in Failed Request Tracing

A procmon trace captured while accessing the web app from the server showed the following:

w3wp.exe 4180 CreateFile C:\inetpub\wwwroot\wss\VirtualDirectories\Web80.Contoso.com80\bin ACCESS DENIED Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating: NT AUTHORITY\IUSR

This issue usually occurs when a request from an authenticated user without local admin rights results in a failed read of the /BIN directory by the impersonating w3wp.exe (IIS worker process for ASP.NET) process. This behavior is typically associated with lack of permissions to the temporary folder /BIN where ASP.Net assemblies are Just In Time (JIT) compiled.

Resolution

The solution is to ensure that the Authenticated Users or <SERVER NAME>\Users group (which usually contains DOMAIN\Users group) has Read & Execute, List Folder Contents and Read permissions on the /BIN folder below C:\inetpub\wwwroot\wss\VirtualDirectories\{Sitename80}. Follow the steps listed below to grant the required permissions:

• Open Windows Explorer and navigate to the /bin directory of your web application
• Right-click on the folder and click on Properties
• Go to Security tab and click on Edit
• Click on Add and add the local server group Authenticated Users or <SERVER NAME>\Users (this usually contains DOMAIN\Users group).
• Select the Read & Execute, List Folder Contents and Read permissions (if you are planning to add Everyone to the /bin folder, grant Read permissions only)
• Click OK to apply the new settings

Refresh the page and we should be able to browse to the site.

There are instances where this permission needs to be re-applied as part of every deployment and we may often find that the permissions have reset after touching the Authentication Providers settings in Central Admin.

More Information

If an administrator accesses the site/feature that caused the error, the subsequent requests from non-administrators would succeed. This behavior is typically associated with lack of permissions to the temporary folder where ASP.Net assemblies are Just In Time compiled.

The freb trace shows a 403.0 for ManagedPipelineHandler

It seems to go through quite a few ASPNet events - but happens during the ASPNetPageRender - it goes to the ASPNetPageRender Enter, then ASPNetHTTPHandler Leave.Only then does it get a 403.0 which is not an official RFC error. The first sub-status for 403 is 403.0.

Application pool in Classic or Integrated mode

1. Application Pool in Classic Mode – In this case, we can configure a Wildcard mapping for ASPNET_ISAPI.dll at the website level. That would propagate to child virtual directories. That should not need any further modifications at the virtual directory level.
2. Application Pool in Integrated Mode – In this case, all relevant virtual directories would need individual modifications. They need to be set for specific handler. E.g. ‘book’ virtual directory needs mapping for BookAPI and ‘movie’ directory would need mapping for MovieAPI.

Users receive the following error message when they try to navigate to Site Collection Features page:

Sorry, something went wrong
An error occurred during the compilation of the requested file, or one of its dependencies. Could not write to output file
'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\root\d9bc15df\5100559f\App_Web_managefeatures.aspx.9c9699a8.qtwjbdlb.dll' -- 'The directory name is invalid. '

The error message also appears on other locations as well on the site like while trying to navigate to Site Content Types page, adding a workflow among others.

The cause turned out to be DisableLoopBackCheck was not enabled on the WFEs.

Solution

• DisableLoopBackCheck (As per KB 926642)
• Using PowerShell

New-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name "DisableLoopbackCheck" -value "1" -Property Type Dword

# Find the template name of SharePoint site using PowerShell
$web = Get-SPweb http://SiteUrl
Write-host “Web Template:” $web.WebTemplate ” | Web Template ID:” $web.WebTemplateId
$web.Dispose()

# To get a list of all web templates, use the following PowerShell code

function Get-SPWebTemplateWithId
{
     $templates = Get-SPWebTemplate | Sort-Object "Name"
     $templates | ForEach-Object {
    $templateValues = @{
     "Title" = $_.Title
     "Name" = $_.Name
     "ID" = $_.ID
     "Custom" = $_.Custom
     "LocaleId" = $_.LocaleId
      }

New-Object PSObject -Property $templateValues | Select @("Name","Title","LocaleId","Custom","ID")
      }
}

Get-SPWebTemplateWithId | Format-Table

Below is a list of the web templates and their IDs

Hope this helps.