*Unknown* status for ISAPI Filter

  • Article

Hello All,

I have seen this issue on IIS 6 a number of times and thought of sharing it with all.

How many times have you seen the below screenshot in the ISAPI Filter tab in IIS MMC ?

image

Well I reproduced this issue with UrlScan for everybody's benefit but this can happen to any ISAPI Filter. I know I got rid of this error as soon as I requested the web page but most of the times the request will fail.

There are a few key elements for every ISAPI Filter and the two we are concerned with are FilterFlags and FilterState. So if you install an application and that application installs an ISAPI Filter on IIS which shows *Unknown* in IIS MMC., then there is something wrong on registering that ISAPI with IIS and hence the error.

Here is the MSDN article which explains these two parameters FilterFlags and FilterState.

Let’s us see Metabase.xml for the above issue

image

See those parameters, they are not set correctly, infact sometimes (as I have seen) the parameters are missing.

So, How do you resolve such an issue ?

Firstly, we need to understand what function the ISAPI Filter will perform. If you are not aware of the same contact the vendor.

In our case we know UrlScan will run under High Priority and will do the following “NotifyPreProcHeaders | NotifySendResponse | NotifySendRawData | NotifyEndOfRequest | NotifyEndOfNetSession | NotifyOrderHigh”. The Flags are explained very well in the FilterFlags document on MSDN.

So what do we do, just add the above text for FilterFlags and change the FilterState to ”1”.

image

Remember to restart IIS after you make the above changes.

Here is what it looks like in Metabase Explorer

image

Check that Data value “542144” that’s nothing but the total of Bitmask used i.e. “NotifyPreProcHeaders | NotifySendResponse | NotifySendRawData | NotifyEndOfRequest | NotifyEndOfNetSession | NotifyOrderHigh”.

NOTE:

Please keep this in mind <MSDN Snip> "Because this property is internally configured by IIS, you should consider it to be read-only. Do not configure this property." </MSDN Snip> .

HTH