SYMPTOMS
If you try to open a Web site on a Microsoft Internet
Information Services (IIS) Web server by using the FrontPage client while
either the
IUSR_computer or
IWAM_computer account is turned off, you may receive error messages in the
FrontPage client indicating the server extensions are not installed. Or, you
may receive following error message:
HTTP 500 - Internal
server error
Additionally, the Event Viewer logs on your Web server
may contain error messages similar to the following:
- If IUSR_computer is turned off:
- In your Application log:
Event Type: Error
Event Source: IISADMIN
Event Category: None
Event ID: 102
Date: 1/1/2002
Time: 12:00:00 PM
User: N/A
Computer: COMPUTER
Description:
IISADMIN service found that account IUSR_<COMPUTER> is disabled.
Some IIS functions can fail for this reason.
- In your System Log:
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 100
Date: 1/1/2002
Time: 12:00:00 PM
User: N/A
Computer: COMPUTER
Description:
The server was unable to log on the Windows NT account
'IUSR_<COMPUTER>' due to the following error:
Logon failure: account currently disabled.
The data is the error code.
Data: 0000: 33 05 00 00
- In your Security Log:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 1/1/2002
Time: 12:00:00 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER
Description:
The logon to account: IUSR_<COMPUTER>
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: COMPUTER
failed. The error code was: 3221225586
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 531
Date: 1/1/2002
Time: 12:00:00 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER
Description:
Logon Failure:
Reason: Account currently disabled
User Name: IUSR_<COMPUTER>
Domain: COMPUTER
Logon Type: 3
Logon Process: IIS
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: COMPUTER
- If IWAM_computer is turned off:
- In your Application log:
Event Type: Error
Event Source: IISADMIN
Event Category: None
Event ID: 102
Date: 1/1/2002
Time: 12:00:00 PM
User: N/A
Computer: COMPUTER
Description:
IISADMIN service found that account IWAM_<COMPUTER> is disabled.
Some IIS functions can fail for this reason.
- In your System Log:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10004
Date: 1/1/2002
Time: 12:00:00 PM
User: N/A
Computer: COMPUTER
Description:
DCOM got error "Logon failure: account currently disabled." and
was unable to log on .\IWAM_<COMPUTER> in order to run the server:
{3D14228D-FBE1-11D0-995D-00C04FD919C1}
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 36
Date: 1/1/2002
Time: 12:00:00 PM
User: N/A
Computer: COMPUTER
Description:
The server failed to load application '/LM/W3SVC/1/ROOT'.
The error was 'The server process could not be started because the
configured identity is incorrect. Check the username and password.'
- In your Security Log:
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 681
Date: 1/1/2002
Time: 12:00:00 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER
Description:
The logon to account: IWAM_<COMPUTER>
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: COMPUTER
failed. The error code was: 3221225586
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 531
Date: 1/1/2002
Time: 12:00:00 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER
Description:
Logon Failure:
Reason: Account currently disabled
User Name: IWAM_<COMPUTER>
Domain: COMPUTER
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: COMPUTER