Re: what hits once per minute?

What's IIS doing that would require a login? What happens if you shut it
down?

You should be able to figure this out by going to Services and seeing what
runs under an account for which you changed the password. Most of the
services probably run under system accounts, so you won't have too many to
wade through. On the laptop I'm using now, there are no services that run
under user accounts or Administrator. The other thing you could check would
be to go into the properties of your user profile and find the saved
passwords. Maybe there's something with a saved password that does
something automatically. And the last idea is anything running from the
task scheduler.

Not sure I'm reading you right. Is this a workstation, or the SBS? I'm
assuming a workstation since it was powered down when you arrived. So if
there were log entries prior to your arrival, someone was logged in with
your password? I hope I'm wrong about that for a number of reasons.


"MDBJ" <me@xxxxxx> wrote in message
news:%233HVlIH6FHA.1188@xxxxxxxxxxxxxxxxxxxxxxx
> Yesterday my machine was off when I got to it in the morning, and I saw
> just before shutdown time
> some weird entries in the log--that predated my getting up for the day
>
> first thing I did was change a few passwords.. this morning, I have 1390
> identical failed logons
> by my account into the machine. logon type 8- cleartext? they occur
> every minute or minute+1sec
> since I changed my pass...
>
> the timing indicates to me- it's a process running that can no longer get
> in...
> (I've changed a few things below-inside the ' ')
>
> logon Failure:
> Reason: Unknown user name or bad password
> User Name: 'mine-power user acct name-not admin'
> Domain: 'mydomain'
> Logon Type: 8
> Logon Process: IIS
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: 'server name'
> Caller User Name: 'server name'$
> Caller Domain: 'domain'
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 1336
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
> any ideas?
>
>


.

Relevant Pages

  • IIS, Trend, Exhaustion, Permissions, Heelp!!!
    ... passwords using IIS and adsutil as in List 2. ... Logon Failure: ... Caller User Name: NETWORK SERVICE ... To reset the password for the IUSR_ComputerName account, ...
    (microsoft.public.windows.server.sbs)
  • Re: Kerberos Problem with App Pool running as Domain Account
    ... SPNs registered for the DNS alias and the server name, ... account, perhaps IIS itself has to as well (instead of the IUSR_IISSERVER ... An error occurred during logon ... Caller User Name: IISSERVER$ ...
    (microsoft.public.inetserver.iis.security)
  • Re: Service principal name (SPN) / Active Directory Problem
    ... HOST/servername.domain.com SPNs ... I think it must be some custom user; the Identity is set to an account ... Event Category: Account Logon ... Caller User Name: - ...
    (microsoft.public.inetserver.iis.security)
  • Re: Thousands of security failure events created by inetinfo.exe
    ... This is originating from the IIS. ... Logon Failure: ... Caller Domain: TECHDYNAMICS ... Also, when I look at the IIS Admin service, it is set ...
    (microsoft.public.windows.server.sbs)
  • Failed Logon Attempts
    ... It appears as though they hit the "admin" account & ... Logon account: admin ... Source Workstation: SERVER ... Caller User Name: SERVER$ ...
    (microsoft.public.windows.server.sbs)
Loading