Re: identify disabled users and bad bad passwords

From: Bernard (qbernard_at_hotmail.com.discuss)
Date: 12/22/04 

Date: Wed, 22 Dec 2004 12:07:55 +0800

My guess for 401 only support file is because 401.X is related to access
error. which probably related to dynamic scripting, etc, hence IIS only
allows you to send back static file content that doesn't need to be
'intepret' by all isapi filter. inetinfo.exe will read the content and send
it back to clients. 

-- 
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/
"Scilabop" <scilabop@Xuvic.ca> wrote in message 
news:e2z9ww65EHA.1452@TK2MSFTNGP11.phx.gbl...
> Thank you, Bernard.
>
> I tried. The sc-win32-status codes for disabled account and bad
> username/passward are all "5".
> But the security event log did give the specific failure reasons. I am now
> wondering how I can program with the system log.
>
> Here I got another question.
> I suppose to be able to customize the HTTP error messages by mapping a 
> file
> or URL. But HTTP 401 (-1,-2,-3,-4, -5) just offer the option of mapping to 
> a
> file, but not URL, while all other HTTP errors have the options of both 
> file
> and URL. I found this problem when I was trying to redirect HTTP 401.1
> message to an ASP script. Any one else ever had such problem?
>
> Thanks a lot.
>
> Ally
>
>
>
> "Bernard" <qbernard@hotmail.com.discuss> wrote in message
> news:OwDkQoy5EHA.3368@TK2MSFTNGP10.phx.gbl...
>> Well, 401.1 stands for login failed, hence it could be username/password
>> wrong, it could be account disabled and lockout. Not sure if the win32
>> status code field will give you more detail, but you can try enable it in
>> the w3c extended iis log format.
>>
>> as for the login prompt, it's actually client browse control. IIS only
>> return authentication header and it's up to client browser to react.
>>
>> -- 
>> Regards,
>> Bernard Cheah
>> http://www.tryiis.com/
>> http://support.microsoft.com/
>> http://www.msmvps.com/bernard/
>>
>>
>>
>> "Scilabop" <scilabop@Xuvic.ca> wrote in message
>> news:%23pBcz6H5EHA.1404@TK2MSFTNGP11.phx.gbl...
>> > Hello,
>> >
>> > We are using IIS5.0 and integrated windows authentication to protect
>> > network
>> > resource.
>> > The system takes both disabled accounts and bad username and password
>> > pairs
>> > as HTTP401.1 error. My task is to distinguish these errors, and then
> take
>> > corresponding actions. But I have problem to retreive the unauthorized
>> > username.
>> >
>> > I am really curious about what triggers those .htr files within
>> > /inetsrv/iisadmpwd. Is that the iisadminpwd.dll file controls
> everything?
>> > If
>> > I could look into the source code for the little popup authentication
>> > window, my task would be easy to get done.
>> >
>> > Any helps are appreciated.
>> >
>> > Ally
>> >
>> >
>> >
>> >
>>
>>
>
>

Relevant Pages

  • Re: [PHP] Authentication
    ... If memory doesn't fail me, if you work with IIS and protect the source pages of the application so that IUSR_xxxxx doesn't have access to those files and instead grant access to the NT users or groups which you want, the IIS when working with IE clients will take care of that as long as they are all in the same domain. ... I did it with IIS 3 and IE4 and it worked, I am not completely sure about the details, but it is something you do in the server administration and you don't need to do any programming at all, if the person reaches the page it is because it is who he says it is. ... Otherwise, no browser will give you access to any sensitive information on the client machine, nothing that someone, anyone, might pick on the server side just by receiving a page request. ... If you can find a JavaScript function to snoop the username, ...
    (php.general)
  • RE: IIS 4 Security
    ... > Subject: IIS 4 Security ... > password protected web site is hosted using IIS 4 w/o ... > username and password. ... I would probably exploit 'Malformed HTR Request', ...
    (Focus-Microsoft)
  • Re: Integrated Windows Authentication
    ... > Yes the IIS is part of a domain... ... > The error is just access denied in the browser after 3 attempts at putting ... > in the username and password. ... >> Rgds. ...
    (microsoft.public.inetserver.iis.security)
  • Re: security between serving files from a fileshare
    ... Microsoft MVP - Windows Security ... Any other ideas, as I can browse to the file in iis manager, yet I ... When entering username ...
    (microsoft.public.inetserver.iis.security)
  • Re: Extended logging?
    ... does the logging work? ... >> Bernard Cheah ... close IIS MMC, restart IIS service, re-open IIS ... When I later check the same tabs, the Extended Properties ...
    (microsoft.public.inetserver.iis)