Windows Forum

Ask something
Discussion Locked

Propfind notation in IIS 4.0 log file

0 helpful
4 replies

by jmgesd 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have noticed a propfind notation in my IIS 4.0 log file for the last few days. It references the propfind command, gives the name of the user, a path to the C$ share, and a netlogon notation.

I do not work with IIS very much and am wondering what this means. Is it detrimental to run the propfind command on a regular basis? Is this an outside hacker, or is the user (who claims innocence) up to no good?

4 replies

by glenfahan

If it is only once a night, I don't know what your cause could be. If you see patterns of two propfinds and restarts afterwards, you could be the victim of a hacker. Sending two large propfinds will restart a server.

This discussion is closed to new replies.