I cannot login via FTP using non-admin accounts. I get "User not allowed to logon at this computer" in the event logs. I am running IIS 5.0 on Windows 2000 Server. This is a stand-alone server (no AD).
I have checked/done the following:
- verified that the "ftpuser" has "Log on Locally" permissions set
- the IUSR_ accounts also have "Log on Locally" and "Log on as a Batch Job" permissions set
- administrator user CAN login via FTP (so I doubt if it's the IUSR_ permissions???)
- "ftpuser" has "Full Control" permissions on the FTP directory (I did "Full Control" for testing purposes and will
reduce the access to "Read and Execute".)
- all non-admin accounts result in the same login errors listed below.
Error message from the event logs:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 533
Date: 12/23/2004
Time: 9:40:07 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVER1
Description:
Logon Failure:
Reason: User not allowed to logon at this computer
User Name: ftpuser
Domain: SERVER1
Logon Type: 2
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
Workstation Name: SERVER1
Event Type: Warning
Event Source: MSFTPSVC
Event Category: None
Event ID: 100
Date: 12/23/2004
Time: 9:40:07 AM
User: N/A
Computer: SERVER1
Description:
The server was unable to logon the Windows NT account 'ftpuser' due to the following error: Logon failure: user not allowed to log on to this computer. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Data:
0000: 31 05 00 00 1...
Is there something else I need to do? I have locked down four servers with a security template similar to hisecws.inf but only this server has this particular FTP login problem.
This problem seemed to occur around the time the Security Event Log filled up and halted the system (we had CrashOnAudit set). We had since rebooted the server and cleared the Event Logs but still cannot log in. We were able to prior to the system halting. Is there a flag somewhere that needs to be reset?