Adam,
If you can log in as an Admin you probably will find:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\crashonauditfail set
to 2. And your security log might be full.
Empty it and set that to 1. Reboot
Regards,
Dave Kleiman
www.SecurityBreachResponse.com www.ComputerForensicInvestigations.com
> -----Original Message-----
> From: hartmann [mailto:hartmann_at_thestar.com.my]
> Sent: Wednesday, March 16, 2005 23:43
> To: 'Security Basics Mailing List'
> Subject: IUSR issue after patch
>
> - The server was unable to logon the Windows NT account
> 'IUSR_machinename'
> due to the following error: Logon failure: user not allowed
> to log on to this computer. The data is the error code. -
>
> Any ideas guys?
> All sites hosted by this web server are now inaccessble after
> a full system patch.
>
> Please help, and thanks a million in advance.
>
> Regards,
> Adam
>
>
>
> /******************************************************************\
> This message and any attachment(s) are confidential and may
> be privileged or otherwise protected from disclosure. If you
> are not the intended recipient, please telephone or e-mail
> the sender and delete this message and any attachment from
> your system. If you are not the intended recipient you must
> not copy this message or attachment or disclose the content
> to any other person.
>
> Any opinion, view and/or other information in this message
> and/or any attachment(s) hereto which do not relate to the
> official business of Star Publications (Malaysia) Bhd shall
> not be deemed given nor endorsed by Star Publications
> (Malaysia) Bhd. Our company is not responsible for any
> activity that might be considered to be an illegal and/or
> improper use of email.
>
> E-mail transmissions cannot be guaranteed to be secured or
> error-free as information could be intercepted, corrupted,
> lost, destroyed, delayed, incomplete or contain viruses. The
> sender therefore does not accept liability for any errors or
> omissions in the contents of this message or for any virus
> damage which may arise as a result of this e-mail transmission.
> /******************************************************************\
>
>
Received on Mar 17 2005
Intro
