Account Lockout (Event ID: 539) Alert on <Servername>

EasyUp Web Hosting

EasyUp Web Hosting

EasyUp Web Hosting
Company Rep
Joined
Mar 18, 2008
Messages
8,517
Reaction score
43
Location
Alberton
Hey Guys/Gals,

I have been struggling with this problem for a while now. Google hasn't helped me. :(

Event viewer entries:
Event ID 539
Reason: Account locked out
User Name: IUSR_<server_name>
Domain: OAKSURE
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <server_name>
Caller User Name: NETWORK SERVICE
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E4)
Caller Process ID: 2244
Transited Services: -
Source Network Address: -
Source Port: -

and...
Event id 529
Reason: Unknown user name or bad password
User Name: IUSR_<server_name>
Domain: OAKSURE
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <server_name>
Caller User Name: NETWORK SERVICE
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E4)
Caller Process ID: 6916
Transited Services: -
Source Network Address: -
Source Port: -

I know the problem should be with WSUS, as I am getting these errors as well with the server reports...

The Reporting Web Service is not working.
The Client Web Service is not working.
The Server Synchronization Web Service is not working.
The SimpleAuth Web Service is not working.
The DSS Authentication Web Service is not working.
Self-update is not working.

Now, What I have done already.

Ran adware
Ran Spybot
Ran MS Baseline security analyzer
Reset the IUSR_<server_name> and changed it where I should.
Checked wep page security and made sure anon is enabled.
Upgraded to WSUS 3.0 SP2
And a lot more... Just forgot what I did... :)

Anywho, If anyone has anything else I can try, please let me know. BTW, new install is out of the question for now as this is the main server at my client.

They are running MS SBS 2003 with SP2, exchange, WSUS, file server and IIS.
 
SharkBait said:
Hey Guys/Gals,

I have been struggling with this problem for a while now. Google hasn't helped me. :(

Event viewer entries:
Event ID 539
Reason: Account locked out
User Name: IUSR_<server_name>
Domain: OAKSURE
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <server_name>
Caller User Name: NETWORK SERVICE
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E4)
Caller Process ID: 2244
Transited Services: -
Source Network Address: -
Source Port: -

and...
Event id 529
Reason: Unknown user name or bad password
User Name: IUSR_<server_name>
Domain: OAKSURE
Logon Type: 8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <server_name>
Caller User Name: NETWORK SERVICE
Caller Domain: NT AUTHORITY
Caller Logon ID: (0x0,0x3E4)
Caller Process ID: 6916
Transited Services: -
Source Network Address: -
Source Port: -

I know the problem should be with WSUS, as I am getting these errors as well with the server reports...

The Reporting Web Service is not working.
The Client Web Service is not working.
The Server Synchronization Web Service is not working.
The SimpleAuth Web Service is not working.
The DSS Authentication Web Service is not working.
Self-update is not working.

Now, What I have done already.

Ran adware
Ran Spybot
Ran MS Baseline security analyzer
Reset the IUSR_<server_name> and changed it where I should.
Checked wep page security and made sure anon is enabled.
Upgraded to WSUS 3.0 SP2
And a lot more... Just forgot what I did... :)

Anywho, If anyone has anything else I can try, please let me know. BTW, new install is out of the question for now as this is the main server at my client.

They are running MS SBS 2003 with SP2, exchange, WSUS, file server and IIS.
Click to expand...


Hi , I take it the MS SBS 2003 has AD ? Its the only problem that account lock out ? What account is it ?:rolleyes:
 
IIS

Hi SharkBait

I had a similar problem and it was sorted by using Microsoft's IIS team
Authentication and Access Control Diagnostics (AuthDiag).

But it does seem like an IIS problem to me, but it could be anything using the ISUR_ account.

This is a little concerning:

Reset the IUSR_<server_name> and changed it where I should.

I would think this took a while to change. Anyway let me knowhow it goes with the AuthDiag?

Regards
 
I will google for it and then try it, thanx. One of the resolutions I got from google was that between IIS and the username, the password looses sync, some how, and that you have to reset the password and then change it on all the VD folders in IIS and wherever else you use it. So, that's why I did it.
 
K, I ran that AuthDiag and all the VDs configured with IUSR_<servername> had a problem. Configured it with another username and password and now there is no errors. Will check if I get the mail again, but I think it is solved. Thank You very much.
 
SharkBait said:
K, I ran that AuthDiag and all the VDs configured with IUSR_<servername> had a problem. Configured it with another username and password and now there is no errors. Will check if I get the mail again, but I think it is solved. Thank You very much.
Click to expand...

glad its sorted! :D
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X