HTTP 403.9 - Access Forbidden: Too many users are connected

As far as I can tell, this problem is different to all of the other posts I have seen on this site that are logged under the same problem.

I have IIS 5.1 running on Windows XP Pro. The main use for this is to host MS SQL Server 2000 Reporting Services web application. Everything has worked fine until last week when any attempt to display the default page (http://localhost/reports) returns the error HTTP 403.9 - Access Forbidden: Too many users are connected.

I have been to the properties of the Default Web Site and removed the tick from the HTTP Keep-Alives Enabled. This did not correct the problem.

I have restarted IIS with IISRESET several times. After a reset, attempts to access the Reports site seems to take a long time but not return any results, it seems to just sit there saying "Opening page reports at localhost ..." until I click stop. Then if I try again, it just comes back with the 403.9 error.

I used Performance monitor to track Web Service Current Connections (I am just guessing this is the right metric) and it starts at 0 and then every 30 seconds or so another connection is made until it reaches the max. of 10.

If I am quick, I can get the http://localhost/localstart.asp page to display after an IISRESET but the connection count still increments until 10 is reached and from then on I get the 403.9. I have also managed to get the http://localhost/reportserver page to display and navigate but performance is pretty slow and I have not managed to render a report this way.

It is almost as though ASP.NET is broken on my machine and there is something running that is taking connections to my website until there are no connections left. This suggests some kind of virus or denial of service attack on my machine. I have Symantec AntiVirus Corporate Edition running and it is regularly updated so I would be surprised if this is the case but I have run out of ideas.

Can anyone offer any helpful suggestions before I need to re-image my machine?
Who is Participating?
meverestConnect With a Mentor Commented:

by default the logs are in C:\WINDOWS\system32\LogFiles\W3SVC1


check the IIS web server logs which will show you what IP address/es are making hots to the web site.  IT could well be one or more code red infected computers on your network.

eynzAuthor Commented:
Where can I find the IIS web server logs?
eynzAuthor Commented:
My log file was full of lines like this:

00:00:20 POST /BusinessNotificationDeploymentServer/DeploymentServerService.asmx 403

I have uninstalled the Business Notification Services module for Microsoft Business Solutions Navision and restarted my machine and everything is back to normal.

Thanks for your help. I will be following this up with MBS.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.