Warning in System log

Hello!
I have a web-server on Windows2003. There are a lot of ftp virtual directories and web-sites. When the user
access his ftp virtual directory by FTP I get warning in System log. But user can access and modify files in his ftp virtual directory!
Can anybody explain me this errors?

Source: MSFTPSVC
EvenID: 100
The server was unable to logon the Windows NT account 'user's account' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.

Also in Security Log I can see two failure audits.

Source: Security
EventId: 680
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: user's account
Source Workstation: server name
Error Code: 0xC000006A

And second
Source: Security
EventID: 529
Logon Failure:
Reason: Unknown user name or bad password
User Name: user's account
Domain: server name
Logon Type: 8
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: server name
Caller User Name: server name$
Caller Domain: domain name
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1880
Transited Services: -
Source Network Address: -
Source Port: -

jcochran
Wed Nov 26 08:58:20 CST 2003

Looks like someone typed a bad user name or password. Could be normal
error, could be a hack attempt (lame if it occurs infrequently).

Jeff

On Wed, 26 Nov 2003 00:01:18 -0800, "Burtsev Dmitry"
<anonymous@discussions.microsoft.com> wrote:

>Hello!
>I have a web-server on Windows2003. There are a lot of ftp virtual directories and web-sites. When the user
>access his ftp virtual directory by FTP I get warning in System log. But user can access and modify files in his ftp virtual directory!
>Can anybody explain me this errors?
>
>Source: MSFTPSVC
>EvenID: 100
>The server was unable to logon the Windows NT account 'user's account' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
>
>Also in Security Log I can see two failure audits.
>
>Source: Security
>EventId: 680
>Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Logon account: user's account
> Source Workstation: server name
> Error Code: 0xC000006A
>
>And second
>Source: Security
>EventID: 529
>Logon Failure:
> Reason: Unknown user name or bad password
> User Name: user's account
> Domain: server name
> Logon Type: 8
> Logon Process: IIS
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: server name
> Caller User Name: server name$
> Caller Domain: domain name
> Caller Logon ID: (0x0,0x3E7)
> Caller Process ID: 1880
> Transited Services: -
> Source Network Address: -
> Source Port: -
>
>

anonymous
Fri Nov 28 07:21:14 CST 2003

No. User type right login and password. But system write warning in system log and failure audit in security log.

timcof
Tue Dec 16 23:49:34 CST 2003

Is it possible that the user tried to login, put in the wrong password, logged in again with the right password. Check for a success audit on the same account.

Thank you. I hope this information is helpful.

Tim Coffey [MSFT]

This posting is provided ?AS IS? with no warranties, and confers no rights. You assume all risk for your use. © 2001 Microsoft Corporation. All rights reserved.
--------------------
| Thread-Topic: Warning in System log
| thread-index: AcOz83jDGclDcb6IRcGoWrsR/2+VBA==
| X-Tomcat-NG: microsoft.public.inetserver.iis
| From: "=?Utf-8?B?QnVydHNldiBEbWl0cnk=?=" <anonymous@discussions.microsoft.com>
| Subject: Warning in System log
| Date: Wed, 26 Nov 2003 00:01:18 -0800
| Lines: 39
| Message-ID: <4A919903-2C5B-4BBA-833F-012276770B67@microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.inetserver.iis
| NNTP-Posting-Host: tk2msftcmty1.phx.gbl 10.40.1.180
| Path: cpmsftngxa06.phx.gbl!cpmsftngxa08.phx.gbl!cpmsftngxa10.phx.gbl
| Xref: cpmsftngxa06.phx.gbl microsoft.public.inetserver.iis:285487
| X-Tomcat-NG: microsoft.public.inetserver.iis
|
| Hello!

I have a web-server on Windows2003. There are a lot of ftp virtual directories and web-sites. When the user

access his ftp virtual directory by FTP I get warning in System log. But user can access and modify files in his ftp virtual directory!

Can anybody explain me this errors



Source: MSFTPSV

EvenID: 10

The server was unable to logon the Windows NT account 'user's account' due to the following error: Logon failure: unknown user name or bad password.
The data is the error code



Also in Security Log I can see two failure audits



Source: Securit

EventId: 68

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_

Logon account: user's accoun

Source Workstation: server nam

Error Code: 0xC000006



And secon

Source: Securit

EventID: 52

Logon Failure

Reason: Unknown user name or bad passwor

User Name: user's accoun

Domain: server nam

Logon Type:

Logon Process: IIS

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_

Workstation Name: server nam

Caller User Name: server name

Caller Domain: domain nam

Caller Logon ID: (0x0,0x3E7

Caller Process ID: 188

Transited Services:

Source Network Address:

Source Port:






|