Results 1 to 5 of 5

Thread: 100's of logon errors for MSFTPSVC, event id: 100

  1. #1
    Join Date
    Sep 2004
    Posts
    65

    100's of logon errors for MSFTPSVC, event id: 100

    We have a system running Small Business Server 2003 Premium, ISA 2004, SQL, WSUS and i have comer across 100's of logon errors for MSFTPSVC with event id: 100. I have come across this error for the first time and i don't have much idea about the same. I am hoping for some one over here to help me out and fix it. Any help for fixing this error will be appreciated, thanks in advance to those who will try to help.

  2. #2
    Join Date
    Sep 2004
    Posts
    65
    I want to know if you are hosting FTP on your SBS. If yes, then i will suggest you to stop FTP and disable its Services and cross check if logon errors for MSFTPSVC stops occurring. In case stopping FTP and disabling its Services help you in getting rid of the logon errors and you don't run in to any issues then you can simply remove the FTP. It will be there in control panel under Add/Remove Windows Components. You just have to select Application Server > IIS > and remove the check box for FTP. As far as i am aware i don't think there is a need of FTP service for accessing external FTP host.

  3. #3
    Join Date
    Sep 2005
    Posts
    179
    I guess you might be having FTP exposed to the outside world. If that's true then some hackers might have listen it on port 21 and they might have tried fluking Administrator password for gaining FTP access. If you don't have a strong admin password, or any of the user has a weak password then hackers can guess it easily. They can also derive a username from an email address. Hacking activity is done via automated scripts, which can scan IP addresses for an FTP server and try thousands of password for logging in one by one. So to avoid these things you should either have a very strong password so that it cannot be fluke easily or disable FTP when not required.

  4. #4
    Join Date
    Jan 2006
    Posts
    2,257
    See if you need FTP site on your SBS and you don't want to disable it then you can create a single user with the right of accessing FTP site all alone. You can set a very strong and secure password for that one. There are quite a few good article over the web explaining everything about the setting a single user for FTP transactions. You can go through a couple of them and follow the one you find the best.

  5. #5
    Join Date
    May 2009
    Posts
    4
    I'm having the same problem. What was the solution to this problem ? Do those warning logs actually mean some is trying different unsername password combinations ?How can you block an IP address access to your server. Or if not that then atleast block from accessing FTP. I dont have any firewall right now, but m gonna get one soon. Till I get one, how can I block that IP in SBS2003 ?

Similar Threads

  1. Event ID 100 MSFTPSVC
    By Federline in forum Active Directory
    Replies: 3
    Last Post: 04-01-2014, 04:08 PM
  2. Logon Error - Event ID 533
    By Kaalan in forum Windows XP Support
    Replies: 8
    Last Post: 03-03-2010, 08:49 AM
  3. Errors in event log
    By montee in forum Operating Systems
    Replies: 4
    Last Post: 19-02-2009, 02:21 PM
  4. Failure Audit - Logon/Logoff - Event ID 529
    By Actionguy in forum Windows Security
    Replies: 2
    Last Post: 28-01-2009, 09:33 PM
  5. Event ID 576/538 - Guest Logon
    By carmen in forum Windows Security
    Replies: 1
    Last Post: 29-10-2007, 10:46 AM

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Page generated in 1,711,728,201.35089 seconds with 17 queries