Re: Experiencing Sporadic HTTP Error 401.1 - Unauthorized errors on IIS

From: WenJun Zhang[msft] (v-wzhang_at_online.microsoft.com)
Date: 05/10/04 

Date: Mon, 10 May 2004 03:24:38 GMT

Hi PhCrypto,

The timestamp is proper. IIS log uses GMT instead of local time zone.
I did see the 401.1 error with anonymous logon. However, the 680
events in security log didn't make much sense, it means IIS attemped
to logon IUSR for anonymous access. Had you seen any failed events
like 533 after the 680?

I'm not sure if WinHTTP Web Proxy service can be the cause of this
problem. IUSR account's password is randomly generated and stored in
System SAM and IIS metabase. Reset it in all these places is a little
inconvenient. I suggest you perform a test: create a new local
account with proper permission(group policy and NTFS, clone IUSR) and
change the problem site to use that account for anonymous access. See
if the problem will still remain or it's only odd on IUSR. Also,
using localhost/127.0.0.1 instead of 192.168.10.62 to test.

Best regards,

WenJun Zhang
Microsoft Online Support
This posting is provided "AS IS" with no warranties, and confers no
rights.
Get Secure! - www.microsoft.com/security

Relevant Pages

  • Re: Removing IUSR_Server User
    ... "Randy Faulkner" wrote in message ... > I created another user for anonymous logon, and applied it to the IIS ... > continue to get security logon failures for IUSR in the event log. ... Somewhere IIS is still trying to use it. ...
    (microsoft.public.inetserver.iis)
  • Re: Anonymous Account not working
    ... the Iusr_ you are using may have been defined before the final ... IIS install on that box. ... I think the problem may be with the local account. ... built the server there was another server that was named WEB02, ...
    (microsoft.public.inetserver.iis.security)
  • Re: Filesystemobject security IIS question...
    ... IIS anon web sites run as IUSR user. ... c:\webs\dir1>> userA has permisions to RXW ... > There should be a directory bind for FSO (ie binding the FSO only to ...
    (microsoft.public.inetserver.iis.security)
  • Re: IWAM out of sync (DCOM error) 10004
    ... password that is cached in the IIS Metabase for the IWAM and IUSR accounts. ... This should show you whether the password is being changed in the metabase. ... If you reset the password on the domain account, ... and IIS is set to control the IUSR password? ...
    (microsoft.public.inetserver.iis.security)
  • Re: Experiencing Sporadic HTTP Error 401.1 - Unauthorized errors on IIS
    ... I created a user identical to IUSR and set this user as the anonymous user ... account in IIS Web Sites. ... All web sites and web pages now return 401.1. ... Access to all IIS resources ...
    (microsoft.public.inetserver.iis)