Fix IIS HTTP Error 500.19 Caused by Invalid or Locked Configuration

Before you begin

Applicable to supported Windows Server/client environments where the named role or feature is installed. Run read-only checks first from an elevated PowerShell or Command Prompt as appropriate. Replace example hostnames, domain names, addresses, ports and paths with values from the affected environment. Record the exact error, timestamp, OS build and scope of impact.

Production safety: obtain change approval and a verified backup before modifying AD DS, DNS, DHCP, firewall, IIS, storage or Hyper-V configuration. Ensure console/out-of-band access before network or remote-access changes.

Symptoms and likely root cause

IIS returns HTTP 500.19 before application code runs; HRESULT may be 0x8007000d, 0x80070021, 0x80070005 or 0x800700b7.

Malformed XML/missing module, locked section, access denied, duplicate entry or invalid module/DLL reference.

Diagnostic commands

%windir%\system32\inetsrv\appcmd list site
%windir%\system32\inetsrv\appcmd list config /section:system.webServer
%windir%\system32\inetsrv\appcmd add backup Before-50019-Fix

Run the commands in order and save the complete output. The commands above are intended to establish the failing layer before a configuration change is attempted.

How to interpret the results

Use full error page, HRESULT, Config Source lines and file path. 0x8007000d commonly indicates invalid/unrecognised configuration; 0x80070021 locked section; 0x80070005 access/permissions; 0x800700b7 duplicate entry; 0x8007007e missing/invalid module. Confirm the exact cause before editing.

Practical correction

Back up IIS config and affected Web.config. Validate XML, install missing IIS module, remove only duplicate entry, or correct read permissions for the site/app-pool identity. Unlock a section only with policy-owner approval; ApplicationHost.config affects all sites.

Make one change at a time. Re-run the failed diagnostic after each change so the cause-and-effect relationship is clear.

Fallback and recovery

Use appcmd list backup and restore the named IIS backup only under an approved recovery plan. Restore prior Web.config copy. Validate affected URL and confirm other sites remain healthy.

Verification checklist

Success: URL returns expected status/redirect and no new 500.19 event; unrelated IIS sites continue working.

• Repeat the original failing operation from the affected client/user or service.
• Test from a second approved endpoint or subnet where relevant.
• Review the relevant event log/IIS log after the fix.
• Record the change, actual result and any remaining limitation.

Frequently asked question

Can I unlock all IIS sections? No. Unlock only the required section after checking central policy.

Official technical reference

Microsoft Learn — http error 500 19 webpage

Use the official documentation for exact version support, prerequisites and any procedure that differs between Windows Server releases.

Technician field note

This runbook describes a controlled diagnostic path; it is not a universal guarantee that every environment has the same cause. If evidence does not match the expected result, stop and investigate rather than applying unrelated fixes. Do not mark the incident resolved until the original symptom is verified as cleared.