On 15 Sep 98 at 11:46, James Kerr wrote:

> Hello all, I am getting an error that is filling up my event log
> on my NT server that is running IIS3 and MS Proxy Serv. 2.0, the
> error is event ID:100 and the event is a warning, it says "The
> server was unable to logon the Windows NT account 'IUSR_NETSERV'
> due to the following error: Logon failure: unknown user name or bad
> password. The data is the error code" (NETSERV is the name of the
> server). I am trying to find out about it on technet but have so
> far come up empty handed, but I haven't given up yet, if anyone has
> any suggestions let me know, thanks.

  I think IIS is supposed to create this account as part of its
installation process [so re-installing IIS may fix the problem].
[IIS attempts to log on as this user locally in order to perform
tasks arising from remote requests.  This account should have just
the rights and permissions needed to perform such tasks.  Since the
event is a "warning", and you don't report other failures, I'd assume
that IIS is getting by with some other account -- possibly
Administrator.  This *potentially* gives remote requests permissions
and rights they should not have, and someone may find a way to
exploit them -- this would be a security hole.]

  The obvious way for this to arise is if someone has deleted the
account.  But it's also possible that IIS was installed before the
machine name was changed to "NETSERV", and so the IUSR_* name that
exists still contains a previous machine name.
  Take a look in User Manager for Domains, and see if such an account
exists, and rename it.

  It's also possible that the password IIS has stored for this
account is different from the actual account password.  You can
change account passwords from User Manager; I don't know where IIS
stores them.

David G

                                  -----
        **Need help with PCSOFT mailing list? Send an Email to:**
        Bob Wright<[log in to unmask]> or Drew Dunn<[log in to unmask]>