Hi there! I am having a bit of a problem and am posting in this newsgroup
because I believe it is related to a crm service.
Specs are SBS 2003 prem, crm 1.2 (both with all avaliable patches).
Last week one of my guys (per another issue) reset the iusr account
password. This caused a waterfall of problems, and i have cleaned up most of
them by following this article
http://forums.msexchange.org/ultimatebb.cgi?ubb=get_topic;f=9;t=001287
and by setting the iusr password on any web service I found.
My problem is that I am still receiving several event 529's from the iusr in
the security log. here is an example.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 8/29/2005
Time: 11:01:06 AM
User: NT AUTHORITY\SYSTEM
Computer: LUCY
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: IUSR_<server>
Domain: mydomain
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: SERVERNAME
Caller User Name: SERVERNAME$
Caller Domain: mydomain
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 11496
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
OK, I ran issapp from the command line and found that this process number
11496 is (at this moment) assigned to the w3 worker process (w3wp.exe) and
that this process was created for the crmapppool.
I went through each application in the pool and (if it was assigned an iusr
identity) corrected the iusr password.
CRM appears to be functioning correctly, but I still cannot find the
application that is causing this event.
Does anyone know of a better way to trace the calling application below the
w3wp service? I am trying to find out which web service is making the logon
attempt.
Any ideas or comments would be appreciated.
Thanks as always..... eric