MOSS Forum

Ask Question   UnAnswered
Home » Forum » MOSS       RSS Feeds

Event ID 534

  Asked By: Tarang    Date: Feb 18    Category: MOSS    Views: 2628

Event ID: 534
Source: Security
Category: Logon/Logoff
Type: Failure Audit
Description Logon Failure:
Reason: The user has not been granted the requested logon type at this machine
User Name: IUSR_Machine_name
Domain: Machine_name
Logon Type:8
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: Machine_name
Caller User Name: MOSS SVC ACCT

Does anyone have any idea why this error continues to show up in the event
viewer security logs? It shows up for all of our MOSS service accounts that are
running their own site collections with their own application pools. It happens
about every 5 minutes. Has anyone else run into this and if so did you find a

I have tried adding the service accounts to the local security policy, under the
"Access this computer from the network" with no luck. The service accounts are
also already listed in the local IIS_WPG but still no luck.



1 Answer Found

Answer #1    Answered By: Varun Mehta     Answered On: Feb 18

Ok so I spent the evening continuing my research and found the problem. The
IUSR_ account is a member of the Guests group and the Guest group is Denied
network access to the machine. So removing the IUSR_ account from the Guests
group will stop the security error but as soon as you add the IUSR_ account back
you start receiving the errors again.

After finding the reason why I was receiving this error that still leaves the
question of what the IUSR_ account and/or the MOSS service accounts are trying
to do.

If anyone has any more information on, what the IUSR_ account is trying to do
within IIS ( I say IIS because the Logon Type:8 means something within IIS) or
why the MOSS service accounts were showing up for the Caller User Name, that
would be great.

It could be that the MOSS service accounts were trying to use the IUSR_ account
to perform some task but again more research is needed.

Didn't find what you were looking for? Find more on Event ID 534 Or get search suggestion and latest updates.