Security

General discussion

Gravatar
0 Votes
Locked

Failed IIS login attempts

By billmez ·
Hello,

We are running a W2K advanced server set up for web server with IIS5, fully patched. The default Administrative web site scripts were not installed, and the default site, etc. is moved from the default location.

My problem is this, I keep on getting login attempts in the security log that resemble the 2 events below:

The logon to account: U158388
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: XXXXXXXX
failed. The error code was: 3221225572


Logon Failure:
Reason: Unknown user name or bad password
User Name: U158388
Domain: XXXXXXXX
Logon Type: 2
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: XXXXXXXX

I do not have any sites on the server that require a windows logon.

Can anyone tell me how they are calling up an IIS login prompt, and if there is anything I can do to stop this.

They will connect and attempt to login 20 or 30 times on various occasions.

Thanks,
Bill

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

gravatar
Collapse -

IIS logon

by jrice In reply to Failed IIS login attempts

IIS uses system accounts, and special accounts for access. For example a website vistor is actually authenticated using a special account. I would research IIS and in particular all the accounts it creates when installed. Check those accounts and ensure they have the permission needed to function

Hope that helps

Back to Security Forum

Start or search

Related Discussions

Related Forums