Hi,
I created a new IUSR account as per the following article to help prevent any potential security breach.
http://www.microsoft.com/technet/community/columns/insider/iisi1102.mspx
I set a good password and made the account just like the existing account.
Then i went into IIS manager, right-clicked on 'web sites', selected 'Directory Security' and in there i selected my new account as the new account for anonymous access.
Now i have a huge spam of failure audits on this server in my event logs (event id 680 and 529)
What could be causing these? - they are mainly coming from one other server in particular.
Event Type: Failure Audit
Source: Security
Event Category: Logon/Logoff
Event ID: 529
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain: SERVER1
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: SERVER2
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.1.214
Source Port: 3876
Category: Account Logon
Event ID 680
NT AUTHORITY\SYSTEM
COMPUTER: SERVER1
Logon attempt by: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
Logon account:
Source Workstation: SERVER2
Error Code: 0xC0000064
Any help is appreciated.
Thanks in advance
IIS 6.0: HOW TO: Configure IIS to Control the Anonymous Password
http://support.microsoft.com/kb/332167/en-us