appcmd restore backup "bachupname" results in ERROR ( hresult:80070005, message:Command execution failed Access is denied)

1. Misconfigured Permissions on the backup directory or IIS configuration files.
2. IIS-related services not having sufficient access.
3. A corrupted IIS configuration or locked files preventing restoration.

Steps to Resolve Access Denied for appcmd restore backup​

Step 1: Verify Backup Directory Permissions​

%windir%\System32\inetsrv\backup

1. Check Permissions on the Backup Folder:
   • Navigate to:
     
     Code:

      C:\Windows\System32\inetsrv\backup

   • Right-click the folder, select Properties > Security tab.
   • Ensure the following accounts have Read/Write access:
     • Administrators
     • SYSTEM
2. Explicitly Grant Permissions if Needed:
   • Add your user account or Administrators manually:
     • Click Edit > Add... > Enter your admin username or Administrators.
     • Grant Full Control to the folder.

Step 2: Ensure Elevated Admin Privileges​

1. Force elevated CMD mode:
   • Search for Command Prompt, right-click it, and select Run as Administrator (again).
2. Attempt the Command Again:
   
   Code:

   bash appcmd restore backup "backupname"

Step 3: Verify that IIS Services Are Running​

1. Check IIS service status:
   
   Code:

   bash net start W3SVC net start WAS

2. If services are stopped, start them manually using the above commands.

Step 4: Bypass UAC (As a Test)​

1. Temporarily disable UAC:
   • Open Control Panel > User Accounts > Change User Account Control Settings.
   • Lower the slider to Never notify.
   • Reboot the server (if prompted).
2. Retry the appcmd restore backup command:
   
   Code:

   bash appcmd restore backup "backupname"

3. Re-enable UAC after testing.

Step 5: Confirm Integrity of the Backup​

1. Inspect the Backup Folder:
   • Navigate to:
     
     Code:

      C:\Windows\System32\inetsrv\backup\<backupname>

   • Ensure the backup folder contains the required files, including:
     • applicationHost.config
     • metaBase.xml (if IIS 6 compatibility is enabled).
2. If the Backup is Corrupt:
   • Try another backup file from the directory (test restoring a different backup using the same command).

Step 6: Run appcmd Restore via Safe Mode​

1. Reboot into Safe Mode:
   • On reboot, press F8 repeatedly (or Shift+F8).
   • Choose Safe Mode with Networking.
2. Restore Backup in Safe Mode:
   • Try the command again in Safe Mode:
     
     Code:

     bash appcmd restore backup "backupname"

3. Reboot into normal mode once the restore is complete.

Step 7: Check System Logs for IIS Errors​

1. Open Event Viewer:
   • Check Windows Logs > System or Applications and Service Logs > IIS-Configuration for errors around the time of the failed restore.
2. Look for Specific Errors:
   • File locking, missing privileges, or mismatched metadata errors related to IIS or appcmd.

Step 8: Elevated Manual Restore​

1. Navigate to the backup folder:
   
   Code:

    C:\Windows\System32\inetsrv\backup\<backupname>

2. Replace Current IIS Configuration:
   • Backup the current applicationHost.config:
     
     Code:

      C:\Windows\System32\inetsrv\config\applicationHost.config

   • Replace it with the backed-up version from <backupname>.
3. Restart IIS:
   
   Code:

   bash iisreset

Let Me Know!​

• Share any new output/error messages or results from the above steps, and I’ll assist further!
• We're close to resolving this!

Why /timeout:60 Works​

1. Extended Grace Period:
   • The timeout parameter gives additional time for services like Windows Process Activation Service (WAS), W3SVC, or custom app pools to gracefully stop.
   • Without /timeout, these services might still be shutting down when the system assumes failure.
2. Prevents "Access Denied":
   • Delayed services might interfere with stop/start operations when improperly terminated.
   • The added timeout clears processes locked by services.

Steps to Fully Resolve IIS Issues​

Step 1: Verify IIS Service Behavior​

1. List Running Services:
   
   Code:

   bash net start

   • Look for:
     • W3SVC (World Wide Web Publishing Service)
     • WAS (Windows Process Activation Service)
2. Test Manually Stopping IIS:
   
   Code:

   bash net stop W3SVC net stop WAS

3. Restart Services After Testing:
   
   Code:

   bash net start WAS net start W3SVC

Step 2: Verify iisreset Command Timing​

1. Stop IIS with Timeout:
   
   Code:

   bash iisreset /stop /timeout:60

2. Start IIS:
   
   Code:

   bash iisreset /start

3. Restart Entirely:
   
   Code:

   bash iisreset /restart /timeout:60

Step 3: Check for Underlying Delays​

1. Check Application Pool Behavior:
   • Open IIS Manager > Application Pools.
   • Look for app pools with Stopped or Error states.
   • Set all app pools to Recycle Automatically:
     • Right-click the application pool > Select Recycling... > Configure settings.
2. Investigate Event Viewer:
   • Open Event Viewer (eventvwr.msc).
   • Check Windows Logs > System or Applications and Service Logs > IIS-Configuration for errors.

Step 4: Cleanup Configuration if Needed​

1. Run DISM to repair system components:
   
   Code:

   bash dism /online /cleanup-image /restorehealth

2. Test configuration restore for IIS backups using:
   
   Code:

   bash appcmd restore backup "backupname"

Steps to Resolve "Access Denied" for appcmd restore backup​

Step 1: Verify Permissions for the Backup Folder​

1. Navigate to the IIS Config Backup Folder:
   
   Code:

    C:\Windows\System32\inetsrv\backup

2. Check the Folder and File Permissions:
   • Folder (backup):
     • Right-click and select Properties > Security.
     • Verify the following accounts have Full Control:
     • Administrators
     • SYSTEM
     • If not present, add these accounts and grant Full Control.
   • Files within Backup Folder (applicationHost.config, etc.:
     • Open the backup folder (e.g., C:\Windows\System32\inetsrv\backup\YourBackupName).
     • Repeat the same permission steps for the actual content files.
3. Retry the Restore Command:
   
   Code:

   bash appcmd restore backup "backupname"

Step 2: Ensure Elevated Admin Privileges (Re-check Context)​

1. Launch Truly Elevated Command Prompt:
   • Search for Command Prompt > Right-click > Run as Administrator (again).
   • Type:
     
     Code:

     bash appcmd restore backup "backupname"

Step 3: Stop IIS Services Before Restore​

1. Stop IIS Services:
   
   Code:

   bash net stop W3SVC net stop WAS

2. Retry Restoration:
   
   Code:

   bash appcmd restore backup "backupname"

3. Start IIS Services Again Once Restored:
   
   Code:

   bash net start WAS net start W3SVC

Step 4: Temporarily Disable UAC​

1. Adjust UAC Settings:
   • Open Control Panel > User Accounts > Change User Account Control Settings.
   • Move the slider to Never Notify.
2. Retry the Restoration Command:
   
   Code:

   bash appcmd restore backup "backupname"

3. Reboot and Re-enable UAC Afterwards (Important).

Step 5: Manually Restore a Backup​

1. Navigate to The Backup Location:
   • Example:
     
     Code:

      C:\Windows\System32\inetsrv\backup\YourBackupName\

2. Backup the Current IIS Configuration:
   • Before overwriting, save the current config:
     
     Code:

      C:\Windows\System32\inetsrv\Config\applicationHost.config

   • Copy it to a safe location for later recovery purposes.
3. Overwrite IIS Config Files:
   • Copy the following files from your backup folder and overwrite the originals:
     
     Code:

      applicationHost.config

     Path to overwrite:
     
     Code:

     bash appcmd restore backup "backupname"

     0
4. Restart IIS:
   
   Code:

   bash appcmd restore backup "backupname"

   1

Step 6: Investigate Event Viewer for Clues​

1. Open Event Viewer (eventvwr.msc).
   • Check logs under:
     
     Code:

     bash appcmd restore backup "backupname"

     2
2. Look specifically for:
   • Errors related to file permissions, IIS services, or locked config files.

Optional Step 7: Repair IIS​

1. Backup the Current Config:
   
   Code:

   bash appcmd restore backup "backupname"

   3
2. Reinstall IIS:
   • Uninstall IIS:
     
     Code:

     bash appcmd restore backup "backupname"

     4
   • Reinstall IIS:
     
     Code:

     bash appcmd restore backup "backupname"

     5
3. Restore the Original Config:
   • Use appcmd:
     
     Code:

     bash appcmd restore backup "backupname"

     6

Summary​

Steps to Resolve IIS Restoration Killing W3SVC​

Step 1: Verify the Backup Configuration​

1. Inspect the Backup Files:
   • Navigate to your backup folder:
     
     Code:

      C:\Windows\System32\inetsrv\backup\<backupname>

   • Open applicationHost.config in a text editor (like Notepad or Notepad++).
   • Look for:
     • Invalid XML structure (e.g., unclosed tags).
     • Unrecognized or custom modules (particularly under <system.webServer> or <modules>).
     • Bad site or application references (e.g., <site> pointing to non-existent directories).
2. Repair or Simplify Config (If Necessary):
   • Temporarily simplify the configuration to contain only basic/default settings:
     • Keep <sites> defined for core IIS sites (if critical to restore).
     • Remove custom <modules> or <isapiFilters> entries that might trigger crashes.
   Example: A minimal applicationHost.config backup might look like:
   
   Code:

   xml <configuration> <system.applicationHost> <sites> <site name="Default Web Site" id="1"> <application path="/" applicationPool="DefaultAppPool"> <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" /> </application> </site> </sites> <applicationPools> <add name="DefaultAppPool" /> </applicationPools> </system.applicationHost> </configuration>

3. Retry the Restore Command After Reviewing:
   
   Code:

   bash appcmd restore backup "backupname"

Step 2: Test and Start the IIS Services Directly​

1. Attempt to Start W3SVC:
   
   Code:

   bash net start W3SVC

2. If W3SVC Fails to Start:
   • Check the following logs for error details:
     • Event Viewer > Windows Logs > System or Application.
     • Review failures related to W3SVC, IIS, or WAS (Windows Activation Service).

Step 3: Clear Corrupted App Pools and Sites​

1. List Application Pools:
   
   Code:

   bash appcmd list apppool

2. Default Application Pools to Test:
   • Ensure DefaultAppPool exists and is functional (repair if necessary):
     
     Code:

     bash appcmd add apppool /name:"DefaultAppPool"

3. Remove Corrupted Sites or Apps (Manually Identify Issues):
   
   Code:

   bash appcmd list site

4. Restart IIS Services:
   
   Code:

   bash iisreset

Step 4: Temporarily Disable Problematic Modules​

1. Open your backup applicationHost.config file.
2. Look for <modules>:
   • Temporarily comment or remove any non-standard or custom modules (especially 3rd-party ones).
     Example:
     
     Code:

     xml <modules> <!-- Temporarily remove problematic modules --> <add name="CustomModule" /> </modules>

3. Retry Restore and Restart:
   
   Code:

   bash appcmd restore backup "backupname" iisreset

Step 5: Validate Permissions for IIS Files​

1. Check Config Folder Permissions:
   • Navigate to:
     
     Code:

     xml <configuration> <system.applicationHost> <sites> <site name="Default Web Site" id="1"> <application path="/" applicationPool="DefaultAppPool"> <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" /> </application> </site> </sites> <applicationPools> <add name="DefaultAppPool" /> </applicationPools> </system.applicationHost> </configuration>

     0
   • Ensure the following accounts have Full Control:
     • SYSTEM
     • Administrators
2. Apply Permissions Recursively:
   • Right-click the folder > Properties > Security > Advanced.
   • Check the box "Replace all child object permissions with inheritable permissions from this object."
3. Restart IIS Services:
   • If restoring succeeds, attempt to restart W3SVC again:
     
     Code:

     xml <configuration> <system.applicationHost> <sites> <site name="Default Web Site" id="1"> <application path="/" applicationPool="DefaultAppPool"> <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" /> </application> </site> </sites> <applicationPools> <add name="DefaultAppPool" /> </applicationPools> </system.applicationHost> </configuration>

     1

Step 6: Rebuild Configuration if Restoration Fails​

1. Create a New IIS Baseline:
   • Rebuild IIS with default settings:
     
     Code:

     xml <configuration> <system.applicationHost> <sites> <site name="Default Web Site" id="1"> <application path="/" applicationPool="DefaultAppPool"> <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" /> </application> </site> </sites> <applicationPools> <add name="DefaultAppPool" /> </applicationPools> </system.applicationHost> </configuration>

     2
2. Restore Manual Configurations:
   • Manually migrate the backup file settings (e.g., <sites>, <appPools>) into the new applicationHost.config.

Logs for Debugging​

1. Event Viewer:
   • Review System Logs for W3SVC errors.
   • Look for terms like:
     • "Invalid configuration."
     • "File not found."
2. HTTP Error Logs:
   • Found at:
     
     Code:

     xml <configuration> <system.applicationHost> <sites> <site name="Default Web Site" id="1"> <application path="/" applicationPool="DefaultAppPool"> <virtualDirectory path="/" physicalPath="C:\inetpub\wwwroot" /> </application> </site> </sites> <applicationPools> <add name="DefaultAppPool" /> </applicationPools> </system.applicationHost> </configuration>

     3
3. Application Errors:
   • Review logs for .NET Framework, IIS extensions, or app pools.

Summary of Steps​

• First, simplify and verify the backup's configuration (applicationHost.config) to ensure it is clean and valid.
• Stop IIS services before restoring and validate whether W3SVC can restart after applying the backup.
• If restoration continuously fails due to config issues or W3SVC crashes, rebuild the server’s IIS configuration manually.

Updated Steps to Address Failed Restore​

Step 1: Test by Restoring While IIS Services Are Stopped​

1. Stop IIS Services Properly:
   • Run:
     
     Code:

     bash net stop W3SVC net stop IISADMIN net stop WAS

2. Cleanly Retry the Restore Command:
   
   Code:

   bash appcmd restore backup "backupname"

3. If Successful:
   • Restart the IIS services:
     
     Code:

     bash net start WAS net start W3SVC

4. If the Same Error Occurs:
   Proceed to adjust permissions and identify the locking process in Step 2.

Step 2: Verify and Fix Permissions on IIS Config Files​

1. Go to the IIS Configuration Folder:
   
   Code:

    C:\Windows\System32\inetsrv\config

2. Check File Permissions:
   • Right-click the applicationHost.config file > Properties > Security tab.
   • Verify the following accounts have Full Control:
     • Administrators
     • SYSTEM
   • If any accounts are missing or lack Full Control, add them:
     • Click Edit > Add > Enter the account name and grant permissions.
3. Apply Permissions Recursively:
   • Ensure the same permissions are applied to:
     • The folder containing the config (C:\Windows\System32\inetsrv\config).
     • All child objects/files.
   • To propagate permissions:
     • Open Advanced Security Settings > Enable Replace all child object permissions.
4. Retry the Restore Command:
   
   Code:

   bash appcmd restore backup "backupname"

Step 3: Temporarily Disable UAC​

1. Disable UAC Temporarily:
   • Open Control Panel > User Accounts > Change User Account Control Settings.
   • Move the slider to Never Notify.
   • Reboot the server if prompted.
2. Run the Restore Command:
   
   Code:

   bash appcmd restore backup "backupname"

3. Re-enable UAC afterward (set slider back to original level).

Step 4: Verify Windows Process Locks​

1. Check for Locked Files:
   • Use Process Explorer (Sysinternals) to locate locks:
     • Launch Process Explorer (Admin Mode).
     • Go to Find > Find Handle or DLL.
     • Search for:
       
       Code:

        applicationHost.config

   • Identify the process holding the file handle (common examples: w3wp.exe or inetinfo.exe).
2. Kill Locking Process:
   • Manually terminate the locking process if identified.

Step 5: Use Safe Mode to Bypass Service Interference​

1. Start the System in Safe Mode:
   • Reboot and press F8 (or Shift + F8) to access Advanced Boot Options.
   • Select Safe Mode with Networking.
2. Retry the Restore Command:
   
   Code:

   bash appcmd restore backup "backupname"

3. Reboot Into Normal Mode:
   • After restoring, restart the server and verify if the restoration resolves the issue.

Step 6: Test Manual File Copy (If Restore Still Fails)​

1. Go to the Backup Location:
   • Open:
     
     Code:

      C:\Windows\System32\inetsrv\backup\<backupname>

2. Manually Replace Configuration File:
   • Backup the current config files in C:\Windows\System32\inetsrv\config:
     • Copy the applicationHost.config file to a backup directory.
   • Replace it with the applicationHost.config from <backupname>.
3. Restart IIS Services:
   
   Code:

   bash net start WAS net start W3SVC

Step 7: Review Relevant Logs​

1. Open Event Viewer:
   • Look for errors in:
     
     Code:

     bash appcmd restore backup "backupname"

     0
2. Check Log Entries:
   • Look for entries associated with IISADMIN, W3SVC, or applicationHost.config.
3. Let me know if specific error codes or new patterns emerge from the logs.

Next Steps if Issues Persist​

• Share details about additional error messages or access patterns.
• Let me know if you’ve worked with custom configuration elements or modules that might affect IIS behavior.

Steps to Fix Stuck Services and Restore IIS Functionality​

Step 1: Forcefully Kill Stuck Services​

1. Identify PIDs for Stuck Services:
   • Run the following command to list the status of all services:
     
     Code:

     bash sc queryex type= service state= all

   • Find the following services and note their PID:
     • Net.Pipe Listener Adapter: Service name is NetPipeActivator
     • Net.TCP Listener Adapter: Service name is NetTcpActivator
     • Net.Tcp Port Sharing Service: Service name is NetTcpPortSharing
2. Kill the Processes:
   • Forcefully terminate the services using their PID:
     
     Code:

     bash taskkill /pid <PID> /f

   • Example:
     
     Code:

     bash taskkill /pid 12345 /f

3. Once the dependent services are stopped, stop WAS:
   
   Code:

   bash net stop WAS

Step 2: Validate Services and Clear Corruption​

1. Re-Register the Services:
   • Open Command Prompt (Admin) and run:
     
     Code:

     bash sc config NetPipeActivator start= demand sc config NetTcpActivator start= demand sc config NetTcpPortSharing start= demand sc config WAS start= demand

2. Check Service Dependencies:
   • Confirm required dependencies for these services:
     
     Code:

     bash sc qc NetPipeActivator sc qc NetTcpActivator sc qc NetTcpPortSharing

3. Restart the Services:
   • Start each service sequentially to test dependencies:
     
     Code:

     bash net start NetPipeActivator net start NetTcpActivator net start NetTcpPortSharing net start WAS

Step 3: Repair WCF and Net.TCP Features​

1. Repair .NET Framework Core Features:
   • Fix related features using DISM:
     
     Code:

     bash dism /online /enable-feature /featurename:NetFx4 /all dism /online /enable-feature /featurename:NET-WCF-Services45 /all

2. Repair or Reinstall Net.TCP Support:
   • Add missing Net.TCP features using DISM:
     
     Code:

     bash dism /online /enable-feature /featurename:NET-WCF-TCP-Activation45

Step 4: Temporarily Disable Services to Restore WAS​

1. Disable Net.TCP and Pipe Services:
   • Temporarily disable the stuck services:
     
     Code:

     bash sc config NetPipeActivator start= disabled sc config NetTcpActivator start= disabled sc config NetTcpPortSharing start= disabled

2. Stop and Restart WAS:
   • Now stop and restart the Windows Process Activation Service (WAS):
     
     Code:

     bash taskkill /pid <PID> /f

     0
3. Re-enable the Dependent Services:
   • Set the dependent services back to their defaults:
     
     Code:

     bash taskkill /pid <PID> /f

     1

Step 5: Check for Locked Files​

1. Open Resource Monitor:
   • Open Task Manager > Performance tab > Open Resource Monitor.
   • Check the CPU or Disk tabs.
2. Look for high activity tied to services like:
   • NetPipeActivator
   • NetTcpActivator
3. Kill locking processes manually after identifying them.

Step 6: Investigate Logs​

1. Review Windows Logs:
   • Open Event Viewer > Windows Logs > System.
   • Look for errors tied to:
     • NetPipeActivator
     • NetTcpActivator
     • WAS
     • W3SVC
2. Key Errors to Investigate:
   • Errors related to missing dependencies or file paths.
   • Configuration corruption that references files or features no longer present.

Step 7: Repair Component Store​

1. Run DISM to Repair the Component Store:
   
   Code:

   bash taskkill /pid <PID> /f

   2
2. Run System File Checker:
   
   Code:

   bash taskkill /pid <PID> /f

   3
3. Reattempt the service operations after this.

Step 8: Manual File Restore​

1. Navigate to WAS and dependent service configuration files:
   
   Code:

   bash taskkill /pid <PID> /f

   4
2. Backup both files, then restore from clean defaults or backups.

If Services Are Now Stopped​

• Retry the IIS restore:
  
  Code:

  bash taskkill /pid <PID> /f

  5
• Start the services after the restore completes:
  
  Code:

  bash taskkill /pid <PID> /f

  6

Let Me Know​

1. Corrupted service configuration or bad dependencies.
2. MSMQ components not being properly registered.
3. Permission issues or resource locks.

Steps to Fix Stuck Net.Msmq Listener Adapter​

Step 1: Forcefully Stop the Stuck Services​

1. Find the PID of the Stuck Service:
   Run:
   
   Code:

   bash sc queryex NetMsmqActivator

   • Look for PID in the output (e.g., PID=XXXX).
2. Kill the Process:
   • Forcefully terminate the service process using its PID:
     
     Code:

     bash taskkill /pid <PID> /f

     Example:
     
     Code:

     bash taskkill /pid 12345 /f

3. Retry Stopping WAS:
   
   Code:

   bash net stop WAS

Step 2: Restart MSMQ Components​

1. Stop the MSMQ Service (if running):
   
   Code:

   bash net stop MSMQ

2. Restart the MSMQ Service:
   
   Code:

   bash net start MSMQ

3. Try Starting the Listener Adapter:
   
   Code:

   bash net start NetMsmqActivator

Step 3: Repair MSMQ and .NET WCF Services​

1. Re-enable MSMQ Services:
   • Use the DISM command to ensure that MSMQ components are reinstalled:
     
     Code:

     bash dism /online /enable-feature /featurename:MSMQ-Server /all

2. Repair WCF Services:
   • Run:
     
     Code:

     bash dism /online /enable-feature /featurename:NET-WCF-MSMQ-Activation45 /all

3. Test the Listener Adapter:
   
   Code:

   bash net start NetMsmqActivator

4. Restart WAS:
   
   Code:

   bash taskkill /pid <PID> /f

   0

Step 4: Temporarily Disable Listener Adapter​

1. Disable the Listener Adapter:
   
   Code:

   bash taskkill /pid <PID> /f

   1
2. Stop WAS Again:
   
   Code:

   bash taskkill /pid <PID> /f

   2
3. Retry the IIS Restore:
   
   Code:

   bash taskkill /pid <PID> /f

   3
4. Re-enable the Listener Adapter After the Restore:
   
   Code:

   bash taskkill /pid <PID> /f

   4

Step 5: Rebuild Listener Adapter Registration​

1. Re-register the Service:
   Run:
   
   Code:

   bash taskkill /pid <PID> /f

   5
2. Manually Fix Registrations (As Needed):
   • View or repair configuration files such as machine.config or applicationHost.config.

bash taskkill /pid <PID> /f

1. Restart and Test:
   
   Code:

   bash taskkill /pid <PID> /f

   7

Step 6: Investigate Logs​

1. Event Viewer:
   • Open eventvwr.msc.
   • Look at:
     • Windows Logs > System (search for NetMsmqActivator).
     • Applications and Services Logs > Microsoft-Windows-WAS > Operational.
2. Common Errors to Investigate:
   • Dependencies failing, like MSMQ or .NET WCF.
   • Access or policy issues blocking service startup.

Step 7: Reset Component State​

1. Revert Pending Actions:
   • Clean pending system changes:
     
     Code:

     bash taskkill /pid <PID> /f

     8
2. Repair Component Store:
   • Run:
     
     Code:

     bash taskkill /pid <PID> /f

     9
3. Restart and Re-test Services:
   Retry stopping WAS and running the restore command.

Summary​

1. Force stop the process using taskkill.
2. Repair or reinstall MSMQ services (dism /enable-feature).
3. Rebuild or re-register the NetMsmqActivator service if corruption is causing the issue.