IIS password access

  • Thread starter Thread starter Tim Holmberg
  • Start date Start date
T

Tim Holmberg

Hope this is the right place for this question and I hope someone knows the
answer/reason....

A couple of months ago I set up a Windows 2000 server to do some basic
static web site hosting... the first month was mostly setting up and
testing... during this first month of testing the web server decided one day
it would no longer let me remotely sign in as author/administrator to access
any of the web sites I had running either through FrontPage 2000 or a "web
folder"... It would ask for the user name and password but wouldn't accept
anything as valid. The web sites were still accessible for normal web
browsing for what I already had published but I couldn't get in to make any
additional updates... only thing that seemed to get things working again was
to completely uninstall IIS and then reinstall IIS and re-create the web
sites. I thought this event was odd, raised an eyebrow and said Hmmmmmmmm
but since I was going again I just figured I mucked something up and the
re-install corrected it.

Well, once again the web sites I have setup on the web server will no longer
accept author/administrator sign on... the sites are up and running and
accessible from the web but I can't get in to make changes/updates.

The Win2K server is up to date on all SP and critical updates... I can't
think of anything I did on the web server that would cause this... there is
nothing in any of the event logs that look abnormal/unusual.. I usually
don't even touch the web server at all and do everything remotely.... I even
tried uninstalling/installing the FP2K extensions to see if that would have
any effect but no help there... I really REALLY don't want to
uninstall/install IIS again... and even if I do it probably will happen
again.

Does anyone have any ideas what is going on here? Any and all
ideas/thoughts accepted!!!

Thanks, Tim
 
Tim Holmberg said:
Hope this is the right place for this question and I hope someone knows the
answer/reason....

A couple of months ago I set up a Windows 2000 server to do some basic
static web site hosting... the first month was mostly setting up and
testing... during this first month of testing the web server decided one day
it would no longer let me remotely sign in as author/administrator to access
any of the web sites I had running either through FrontPage 2000 or a "web
folder"... It would ask for the user name and password but wouldn't accept
anything as valid. The web sites were still accessible for normal web
browsing for what I already had published but I couldn't get in to make any
additional updates... only thing that seemed to get things working again was
to completely uninstall IIS and then reinstall IIS and re-create the web
sites. I thought this event was odd, raised an eyebrow and said Hmmmmmmmm
but since I was going again I just figured I mucked something up and the
re-install corrected it.

Well, once again the web sites I have setup on the web server will no longer
accept author/administrator sign on... the sites are up and running and
accessible from the web but I can't get in to make changes/updates.

The Win2K server is up to date on all SP and critical updates... I can't
think of anything I did on the web server that would cause this... there is
nothing in any of the event logs that look abnormal/unusual.. I usually
don't even touch the web server at all and do everything remotely.... I even
tried uninstalling/installing the FP2K extensions to see if that would have
any effect but no help there... I really REALLY don't want to
uninstall/install IIS again... and even if I do it probably will happen
again.

Does anyone have any ideas what is going on here? Any and all
ideas/thoughts accepted!!!

Thanks, Tim
Click to expand...

There are excellent resources over hardening an IIS server available on the
web. Using a Front page Extensions enabled IIS as a production server is
inherently a security risk.

You might consider using the IISLockdown tool to help your security a little
and take some of the steps detailed in resources aimed at IIS security.
Examples would include placing the IISroot on another NTFS partition than
%systemdrive%, configuring the IIS log files to disallow external access and
using SSL through certificates as well as disable the IIS administrator
interface.

http://www.microsoft.com/technet/security/tools/locktool.asp
 
Back
Top