whos using the IUSER_<compname> account?

[wakubi]

Hello all,

We are running NT4.0 SP6a with win98SE clients.

Ive just inherited the network and I know we shouldnt be running all these services on PDC, but on the PDC we have: WINS, DHCP, Exchange 4.5, RAS, Proxy 2.0

Along time before i came here IIS4 was also running on the PDC, but was removed and we no longer have any machines running IIS on our network.

When I started I discovered that both the IWAM_ and IUSER_<servername> accounts were both still active, dispite us not having IIS installed. Its been along time since ive used IIS, but I thourght these accounts were used by NT to authenticate web clients. (of which we have none)

So I disabled both accounts, but occasionally we recieve a load of event errors (ID 100: W3SVC) saying that the server was unable to log onto the IUSER_ account as the account is disabled.

Does anyone have any ideas to why the server is trying to use the iuser_ account. Is someone trying to hack us or what?
And how do I get more information about whats going on the the system other then the little info that event Viewer gives?

Thanks in advance for any information or help.

Julian K
MCSE/MCP+I

 

[yizhar]

HI.

A quick look at the Event Viewer will give you important information.

Proxy 2.0 *NEEDS* IIS to function!
If you're using it, IIS should also run in some manner.

If this is a SBS server, then the SBS management console is also dependant in IIS.

So I suggest keep IIS working, but limit access to it in your firewall and in ISM, and apply the latest SP + SRP.

If you want to remove IIS - uninstall MSPROXY, and uninstall IIS or disable all related services like:
INDEXING
FTP
IIS ADMIN

http://WWW PUBLISHING

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[wakubi]

Yes thanks Yizhar,
your right, IIS is running, and SBS too. Ok so ive worked out why the iuser and iwam accounts were still active, but they are a security risk along with IIS and Proxy which seem to be configured all wrong.
We do not host any web sites here, so all IIS is doing is just something to carry the Proxy in.

OK so im trying to secure our LAN and proxy server. the first point of call was to disable the World Wide Web Publishing service in IIS.

Do you know why the Web proxy, Winsock Proxy, and socks proxy, all stop running, thus ending all access to net from LAN when i stop the web

http://WWWpublishing

service?

Julian K