Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

IIS tracking failed logins for users

2,193 views
Skip to first unread message

TCurtin

unread,
Jul 23, 2010, 1:13:42 PM7/23/10
to
I have Server 2003 IIS 6.0

I am using windows authentication for a web site hosted in IIS.
Anonymous Access is off

In the IIS audit logs the 'cs-username' shows up fine on a successful login.

the 'cs-username' is blank when the user enters a bad password. is there a
way to change this?

The information I need is the number of failed attempts for a user. or is
there another way to ger this info?


Ken Schaefer

unread,
Jul 24, 2010, 12:18:33 AM7/24/10
to
Unless a user authenticates (i.e. the Windows security subsystem says "yes,
this is a valid user") then IIS has no user context to impersonate, and the
request is considered "anonymous" (and then is appropriately denied with a
401.

Your Windows security event logs will track failed login attempts (including
a reason for the failure: e.g. unknown username or bad password, account
disabled etc). You may need to allow failed logon auditing in the local
security policy (or set it via Group Policy).

Cheers
Ken


"TCurtin" <TCu...@discussions.microsoft.com> wrote in message
news:1650F862-5C74-4138...@microsoft.com...

Arnold@arnold.com Mr. Arnold

unread,
Jul 24, 2010, 7:22:59 AM7/24/10
to

"TCurtin" <TCu...@discussions.microsoft.com> wrote in message
news:1650F862-5C74-4138...@microsoft.com...

You can go to the Win 2k3 Audit services and enable the logging of the
successful and failed attempts by a user to login to the server through IIS,
which is kept in the System's Security Event Logs and can be viewed using
the Event Viewer on the O/S.

TCurtin

unread,
Jul 26, 2010, 7:30:04 PM7/26/10
to
I tried this using the event logs and it works most of the time. the only
weirdness is that if i use the machineName.xxxxxx.com/user and an invalid
password the event gets logged as a failure [great]. but if I use the
domainName/user as a login only successes get logged [When a valid password
is used] If I use an invalid password in this case nothing gets logged, any
ideas?

"Mr. Arnold" wrote:

> .
>

Ken Schaefer

unread,
Jul 27, 2010, 6:58:21 AM7/27/10
to
Check the Event Logs on your domain controllers.

Cheers
Ken

"TCurtin" <TCu...@discussions.microsoft.com> wrote in message

news:54906640-5E25-487A...@microsoft.com...

0 new messages