Re: security logon failures?

param_at_community.nospam
Date: 03/04/05 

Date: Fri, 4 Mar 2005 08:10:24 -0600

I cannot see anything in the System Event Log pertaining to W3SVC or IIS.
Both the boxes are running Web Edition and the only services running are IIS
related services. It would seem odd to me that I get the same error on 2
boxes on seperate networks. thanks!

Logon Failure:

Reason: An error occurred during logon

User Name:

Domain:

Logon Type: 3

Logon Process: Schannel

Authentication Package: Microsoft Unified Security Protocol Provider

Workstation Name: -

Status code: 0xC000006D

Substatus code: 0x80090325

Caller User Name: -

Caller Domain: -

Caller Logon ID: -

Caller Process ID: -

Transited Services: -

Source Network Address: -

Source Port: -

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

""WenJun Zhang[msft]"" <v-wzhang@online.microsoft.com> wrote in message
news:vXtxPWIIFHA.3572@TK2MSFTNGXA02.phx.gbl...
> Hi,
>
> Looks like there is nothing indicates the logon failure event has
> some relationship with IIS. Have you also checked System log(for
> events about W3SVC or IISAdmin)? If IIS attempts to logon a built-in
> account but failed, it will write the details in System log.
>
> Thanks.
>
> Best regards,
>
> WenJun Zhang
> Microsoft Online Partner Support
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>

Relevant Pages

  • IIS, Trend, Exhaustion, Permissions, Heelp!!!
    ... passwords using IIS and adsutil as in List 2. ... Logon Failure: ... Caller User Name: NETWORK SERVICE ... To reset the password for the IUSR_ComputerName account, ...
    (microsoft.public.windows.server.sbs)
  • Re: Thousands of security failure events created by inetinfo.exe
    ... This is originating from the IIS. ... Logon Failure: ... Caller Domain: TECHDYNAMICS ... Also, when I look at the IIS Admin service, it is set ...
    (microsoft.public.windows.server.sbs)
  • Re: Failed Logon Attempts
    ... You would have to review your IIS logs to get this info. ... Logon account: admin ... Source Workstation: SERVER ... Caller User Name: SERVER$ ...
    (microsoft.public.windows.server.sbs)
  • Re: what hits once per minute?
    ... What's IIS doing that would require a login? ... runs under an account for which you changed the password. ... logon type 8- cleartext? ... > Caller User Name: 'server name'$ ...
    (microsoft.public.windows.server.sbs)
  • Re: KDC Event ID 7 and Wins startup errors.
    ... Event Type: Information ... Event Source: USER32 ... Logon Failure: ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)