• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1179
  • Last Modified:

IIS Security

  i can see such info in win2k system log (security log):
  successful network logon : user:IUSR_Server domain:Server logon ID:(0x0,0x9D3DD)
                             logon model: 3      logon procedure: IIS
                             authentication process:MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  how this happen?can they really logon my system? what can they do on my machine? i have stoped the SERVER process.but the same infomation still  happen at about 03:00~05:00.
  what can i do then?i want to make my system more strong.    
3 Solutions
Hi martinbjlee,

Run the Microsoft Baseline Security Tool to see if you are well protected or not.
IUSR user is used by IIS and I think its just the IIS process that logs on not a user but run the MBSA tool.


Jason WatkinsIT Project LeaderCommented:
The IUSR_Server account is the generic account used to access resources over HTTP that the server is providing.  This account should not be used to access anything but web-content.  If this server is running IIS 5.0, then you must consider running the IIS lock-down tool to secure Windows 2000 and IIS.

A better option would be to ugrade your installation to Windows Server 2003 and IIS 6.0.

martinbjleeAuthor Commented:
Hi Firebar,
     what shall i do to get "This account should not be used to access anything but web-content".whether the account should be delete from the guest groups?     i will study the IIS lock-down tool.

Hi Trenes,
     i intall the MBSA tool on the server at Friday,but it can't run ,i don't konw what 's the problem.
     what document i can study  to find what the IUSR_Server 's info,i think i must study it .
We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

martinbjleeAuthor Commented:
Hi Firebar,
     where can i download the IIS lock_down tool ?the tool is for IIS 5.0 security ?
Jason WatkinsIT Project LeaderCommented:
The IIS lock-down tool can be downloaded from Microsoft's web-site.  

Try:  http://www.google.com/microsoft  and search for the IIS lock-down tool.  I am sorry, I don't know the exact URL.

I would start by determining the group membership the IUSR account has involvment.  Take the critical areas of the filesystem and make sure that user account and it's groups do not have unauthorized access to that filesystem.  The IIS lock-down tool will help to do exactly that.

Tim HolmanCommented:
Please don't delete the IUSR account, otherwise your web server won't work, and IIS will undoubtedly need reinstalling!
MSBA 2.0 is a good start - but think about other things too -ie physical security, policies, procedures, run regular vulnerability scans, as MSBA alone will not offer you compelte protection.
Forced accept.

EE Admin
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now