source of Failure Audits is Default Web Site

I've inherited an apparently unmaintained environment. I notice that about
half of my Security events on my domain controller SVR2 are:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 3/14/2008
Time: 1:44:25 PM
User: NT AUTHORITY\SYSTEM
Computer: TMG-SVR2
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Administrator
Source Workstation: SVR1
Error Code: 0xC000006A

I start checking SVR1, a W2K box, and eventually find that stopping the
Default Web Site in IIS Admin stops these errors. We have the usual IISHelp,
IISAdmin, IISSamples, and an MSADC. There's a PerlEx web site that I gather
is ActiveState. And there are five websites from a vendor-provided Altiris
offering. Directory Security varies among Anonymous access with Username
IUSR_SVR1 and "Allow IIS to control password" checked, Basic Authentication
with no Domain Name set, and Integrated Windows authentication. I suspect
there is a problem with the IUSR_SVR1 Internet Guest Account, which I do as
a local user on SVR1 as a member of Guests, with Password never expires and
User cannot change password.

At this point, I'm not sure what to do with this. What are good solutions at
ths point?
________
Greg Stigers, MCSA
remember to vote for the answers you like



.

Relevant Pages

  • Re: Event ID 623
    ... Another place to check would be the number of security and distribution ... MVP - Directory Services ... The version store for this instance has reached its ... Event Source: NTDS SDPROP ...
    (microsoft.public.windows.server.active_directory)
  • Re: failure audits
    ... Event Source: Security ... Ignore the Tcpip 4226 Warning, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Event ID 861
    ... I am getting a lot of events in the security log with ID 861: ... Event Type: Failure Audit ... Event Source: Security ...
    (microsoft.public.windowsxp.general)
  • Event ID 861
    ... I am getting a lot of events in the security log with ID 861: ... Event Type: Failure Audit ... Event Source: Security ... Event Category: Detailed Tracking ...
    (microsoft.public.windowsxp.general)