HTTP Error 500.19 - Internal Server Error (config data invalid)

What’s actually happening

500.19 fires while IIS is reading configuration, not while your code runs. The error page is unusually helpful: it prints a Config Error line, a Config Source snippet with the offending lines highlighted, and a hex Error Code. The two you'll see most are 0x8007000d (the config data is invalid/malformed, or references a module that isn't installed) and 0x80070021 (a section is locked at a parent level). Read those three fields before changing anything.

Common causes

• Malformed web.config — a stray tag, bad XML, or an element IIS doesn't recognize. 0x8007000d points straight at this.
• A referenced module or feature isn't installed: the classic is an <aspNetCore> section with the Hosting Bundle missing, or a <rewrite> section without the URL Rewrite module.
• A configuration section is locked at the server level (overrideModeDefault="Deny" or allowOverride="false"), and the site's web.config tries to set it anyway — that's 0x80070021.
• The app pool identity can't read web.config — NTFS permissions on the folder don't grant read to IIS AppPool\YourPool, so IIS reports the data as unreadable.
• applicationHost.config itself is corrupt or hand-edited into an invalid state, breaking every site on the server.

How to fix it

1. Read the Config Source block on the error pageThe error page highlights the exact line number in the exact file. Combined with the hex code this usually pins the problem in seconds — match 0x8007000d to malformed/unknown config and 0x80070021 to a locked section.
2. Install the module the config referencesIf the offending lines are <aspNetCore ...>, install the ASP.NET Core Hosting Bundle and run iisreset. If it's <rewrite>, install URL Rewrite. IIS rejects config for handlers it doesn't have registered.
3. Unlock the section or stop overriding itFor 0x80070021, unlock at the server: appcmd unlock config /section:system.webServer/<section> (run as admin), or in IIS Manager > Configuration Editor set the section's overrideMode to Allow. If you don't control the server, remove that section from the site's web.config instead.
4. Grant read access to the app pool identityGive IIS AppPool\YourPool (and IIS_IUSRS) read on the site folder: icacls "C:\inetpub\yoursite" /grant "IIS AppPool\YourPool:(OI)(CI)R". A fresh deploy that strips inherited permissions is a frequent trigger.
5. Validate the XMLOpen web.config in an editor that flags XML errors, or run it through a parser. One unclosed tag from a bad merge produces this error for the whole site.