HTTP 500.19 on AD CS Web Enrollment After IIS Security Hardening

Jane Smith 0 Reputation points
2026-08-06T01:03:08.2033333+00:00

Our AD CS Web Enrollment (/certsrv) stopped working immediately after applying an IIS security baseline to the CA server. The site now consistently returns HTTP 500.19, while the Certificate Services role itself continues to function normally.

We're trying to identify which IIS configuration changes are breaking the Web Enrollment role. Are there any required Application Pool identity permissions, handler mappings, or ISAPI dependencies that are commonly affected by IIS hardening and should be validated first?

Windows for business | Windows Server | Devices and deployment | Install Windows updates, features, or roles
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Domic Vo 28,365 Reputation points Independent Advisor
    2026-08-06T05:30:11.8733333+00:00

    Hello,

    The 500.19 error after applying the IIS baseline is almost always tied to classic ASP and ISAPI dependencies that Web Enrollment requires. The /certsrv site runs under DefaultAppPool, and the ApplicationPoolIdentity must retain read/execute rights on %systemroot%\system32\certsrv and %systemroot%\system32\inetsrv\asp.dll. If those permissions were stripped, the site fails immediately. You should also confirm that the ASP ISAPI extension (asp.dll) is marked as Allowed under ISAPI/CGI Restrictions, since many baselines disable it. The Classic ASP handler mapping for *.asp must still exist; if removed, IIS cannot process the enrollment pages. Request Filtering rules are another common issue—deny rules for .asp or .cer extensions, or disabling parent paths, will break the site. In short, validate AppPool identity permissions, ISAPI restrictions, handler mappings, and request filtering. Restoring those settings usually resolves the 500.19 error without impacting the CA service itself.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    DV.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-08-06T01:03:35.1833333+00:00

    Start by matching the exact HTTP 500.19 HRESULT shown on the error page. That code determines which IIS hardening change is most likely responsible.

    For /certsrv after IIS hardening, validate these first:

    1. File and config permissions
      • If the HRESULT is 0x80070005, IIS is being blocked from reading configuration or site content.
      • Confirm the IIS_IUSRS group has Read permission on:
        • the folder containing ApplicationHost.config
        • the folder or virtual/application directories associated with the site’s Web.config
      • Ensure permission inheritance reaches the actual ApplicationHost.config and Web.config files.
      • If the site was configured to use a UNC path, avoid UNC pass-through authentication and instead use a user account that has permission to the remote share.
    2. Locked configuration sections
      • If the HRESULT is 0x80070021, a section required by the site is locked at a higher IIS configuration level.
      • Review the section named in the error and either unlock that section or stop overriding it at the site level.
      • This is a common effect of security baselines that tighten IIS configuration inheritance.
    3. Malformed or unrecognized IIS configuration
      • If the HRESULT is 0x8007000d, check ApplicationHost.config and the site Web.config for malformed XML or configuration entries that reference IIS features not installed.
      • Hardening can expose this if a module dependency was removed or disabled.
    4. Duplicate configuration entries
      • If the HRESULT is 0x800700b7, compare the site configuration with parent ApplicationHost.config or parent Web.config files.
      • Remove duplicate entries or make them unique.
      • This can happen when a baseline adds settings already defined for the site.
    5. Missing module or invalid DLL reference
      • If the HRESULT is 0x8007007e, ApplicationHost.config or Web.config is referencing a module or DLL that is missing or invalid.
      • Check for removed IIS modules, handler-related dependencies, or ISAPI-related references that the hardening baseline may have disabled.
      • To identify the bad reference, enable Failed Request Tracing and reproduce the error.
    6. Wrong physical path or unreadable config path
      • If the HRESULT is 0x80070003, verify the site or virtual directory physical path still matches the IIS configuration and that the expected Web.config exists there.
      • Also verify permissions on that path.
      • If needed, collect Process Monitor logs to see which file access is failing.

    For the specific areas mentioned:

    • Application Pool identity permissions: the documented permission to validate first is Read access for IIS_IUSRS to IIS configuration and site directories.
    • Handler mappings / ISAPI dependencies: the documented failure pattern is 500.19 with 0x8007007e when ApplicationHost.config or Web.config references a missing or invalid module or DLL. That is the best match for hardening that disables required components.
    • Configuration lockdown from hardening: 0x80070021 is the key indicator that a required IIS section was locked by higher-level policy or configuration.

    Because the Certificate Services role still works and only Web Enrollment fails, the most likely first checks are:

    1. capture the exact HRESULT from the 500.19 page,
    2. verify IIS_IUSRS Read permissions,
    3. compare ApplicationHost.config and the /certsrv Web.config for locked sections, duplicate entries, or references to removed modules/DLLs,
    4. use Failed Request Tracing or Process Monitor if the HRESULT points to missing modules or file access.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.