Link to home
Start Free TrialLog in
Avatar of barnesgj
barnesgj

asked on

Web server warning event 40968

I am getting the following system event warning at approximately the same time every day.
  Source LsaSrv
  Category:  SPNEGO (negotiator)
  Event:  40968

I am also getting the following entries in my website log file which correspond to the event warning message times:
2007-03-24 15:11:20 W3SVC1 ... GET /iisadmpwd/aexp2b.htr - 80 -  ...  - 403 4 64
2007-03-24 15:11:20 W3SVC1 ... GET / - 80 - 155.147.252.207 - 403 4 5
2007-03-24 15:11:20 W3SVC1  ... GET / - 80 - 155.147.252.207 - 403 4 5
2007-03-24 15:11:20 W3SVC1  ... GET /includes/pnAPI.php oops=id 80 -  ...  - 403 4 5
2007-03-24 15:11:20 W3SVC1  ...  GET /pls/simpledad/admin_/gateway.htm schema=sample 80 -  ...  - 403 4 5
2007-03-24 15:11:20 W3SVC1  ...  GET /cgi-bin/rwcgi60/showenv - 80 -  ...  - 403 4 5

I am running Widows Server 2003 Svc Pk 2 and IIS 6.0.  

This started about 3 weeks ago.  Does anyone know what it is?

Thanks!
ASKER CERTIFIED SOLUTION
Avatar of cj_1969
cj_1969
Flag of United States of America image
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of barnesgj
barnesgj

ASKER

Good answer!  It seems that our network people are doing some scans that appear to be triggering this.
Thanks!!!