Windows Server · medium · Directory & core infrastructure

HTTP 500.19 — the configuration file cannot be read

IIS could parse the request but not the configuration that applies to it. The sub-code after 0x is what identifies the actual cause.

What you see

Every request to a site returns 500.19 with a config file path and an error code. The page names the offending line number, which is genuinely useful.

What is actually wrong

0x8007000d — malformed XML, or a module referenced that is not installed. 0x80070021 — a section is locked at server level. 0x80070005 — the app pool identity cannot read the web.config.

Codes and articles

500.190x8007000d0x800700210x80070005

Fixes (3)

Install the module the config references

Elevated PowerShell on the web server20 minuteslow riskreversible

0x8007000d, and the error page names a section such as <rewrite> or <aspNetCore>.

Read the section name from the error page. It tells you which module is missing.
For <rewrite>: install the URL Rewrite module from Microsoft.
A web.config that uses a rewrite rule is invalid on a server without the module, and IIS reports that as a config read failure rather than a missing feature.
For <aspNetCore>: install the matching .NET Hosting Bundle, then restart IIS.
Command Prompt
```
net stop was /ynet start w3svc
```

List what is installed to confirm.

PowerShell

Get-WebGlobalModule | Select-Object Name | Sort-Object Name

Confirm it workedThe site returns a page.

PowerShell

Invoke-WebRequest http://localhost/ -UseBasicParsing | Select-Object StatusCode

If you need to undo itUninstall the module — the site returns to its previous broken state.

Unlock the section at server level

Elevated PowerShell10 minutesmedium riskreversible

0x80070021 — a site's web.config sets something the server configuration has locked.

Note the section name from the error page.
Unlock it for the whole server.
Command Prompt
```
C:\Windows\System32\inetsrv\appcmd.exe unlock config /section:system.webServer/handlers
```
Sections are locked by default so a site cannot override server policy. Unlocking is a deliberate loosening — only do it for the section named.
If the setting does not belong in the site config, remove it from web.config instead. That is usually the better answer.

Confirm it workedThe site loads.

If you need to undo itappcmd lock config /section:<name>

Grant the app pool identity read access

Elevated PowerShell10 minuteslow riskreversible

0x80070005 — access denied reading the config.

Find which pool the site uses and what identity it runs as.

PowerShell

Get-Website | Select-Object Name, ApplicationPool, PhysicalPathGet-ItemProperty 'IIS:\AppPools\DefaultAppPool' -Name processModel.identityType

Grant read to the pool's virtual account.
Command Prompt
```
icacls "C:\inetpub\wwwroot\site" /grant "IIS AppPool\DefaultAppPool:(OI)(CI)(RX)" /T
```
An app pool runs as IIS AppPool\<poolname>, a virtual account that exists only on this machine. Granting IUSR or Everyone is the usual wrong turn — it works and it is far more access than needed.
Also grant read to IIS_IUSRS if the application needs it.
Command Prompt
```
icacls "C:\inetpub\wwwroot\site" /grant "IIS_IUSRS:(OI)(CI)(RX)" /T
```

Confirm it workedThe site loads and the failed request trace shows no access denied.

If you need to undo iticacls with /remove for the identity you granted.

Reference

HTTP 500.19 troubleshooting — Microsoft Learn ↗

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.