Security – Lots of Logon/Logoff events in the event viewer windows 2003

eventviewerSecuritywindows-server-2003

I seem to be getting a lot of these entries in the Security event viewer. Around 8-12 every hour. I am wondering if a) I should be worried about it? or b) what actually is going on, Can anyone help?

Type: Success Audit
Source: Security
Category: Logon/Logoff
User: Network Service or IUSR_WIN2003


Logon attempt using explicit credentials:
 Logged on user:
    User Name:  NETWORK SERVICE
    Domain:     NT AUTHORITY
    Logon ID:       (0x0,0x3E4)
    Logon GUID: -
 User whose credentials were used:
    Target User Name:   IUSR_WIN2003
    Target Domain:  WILDEBB1
    Target Logon GUID: -

 Target Server Name:    localhost
 Target Server Info:    localhost
 Caller Process ID: 13224
 Source Network Address:    -
 Source Port:   -

Also just after this one was recorded iis stopped accepting connections and I had to reboot the server. The difference to this one is that the logon process used ADVAPI…

Event Type: Success Audit
Event Source:   Security
Event Category: Logon/Logoff 
Event ID:   540
Date:       05/06/2012
Time:       13:59:10
User:       WILDEAA1\IUSR_WIN2003
Computer:   WILDEAA1
Description:
Successful Network Logon:
    User Name:  IUSR_WIN2003
    Domain:     WILDEAA1
    Logon ID:       (0x0,0x5FDB22D)
    Logon Type: 8
    Logon Process:  Advapi  
    Authentication Package: Negotiate
    Workstation Name:   WILDEAA1
    Logon GUID: -
    Caller User Name:   NETWORK SERVICE
    Caller Domain:  NT AUTHORITY
    Caller Logon ID:    (0x0,0x3E4)
    Caller Process ID: 13224
    Transited Services: -
    Source Network Address: -
    Source Port:    -

Best Answer

The IUSR account is the anonymous user account that gets created when you install IIS. Are you running any web sites on that server? You'll see a logon event whenever IIS tries to log the account on for an anonymous user.

Related Topic