External IIS Login attempts

[Virtualp]

Hi,
I have a continuing issue with what appears to be external IIS login attempts on a W2K Webserver.
We receive the following Event ID 100 W3SVC logs in the Event Viewer -

The server was unable to logon the Windows NT account 'miangerj' due to the following error: Logon failure: unknown user name or bad password. The data is the error code.
For additional information specific to this message please visit the Microsoft Online Support site located at:

The account is not local and these attempts can be seen in the Web logs from changing IP address' so I cannot block these address' in the Firewall.

Can anyone shed anylight on how to stop these?

 

[Castor66]

If your web server is on the Internet, albeit behind a firewall, then there isn't a lot you can do about it. Ensure your Web server is sufficiently locked down and the latest patches for your infrastructure applied and you should be ok.

If you want to get rid of these then you would need to invest in an extra layer of security on your network which is not cheap or easy to manage. If you have only 1 webserver it makes little or no sense to utilise such tools.