MonitorWare Knowledge Base

Hi,

I have been using the PasswordManager.dll for a few months now. It's working fine as per described. However, I have some strange occurences (twice, including this one third) once every few months. I had to reload the entire OS the past two times.

We implement a simple IIS web security settings, that require users to key in their user id and password via the usual windows web-folder login. This unexplainable symptom we are encountering is that the login will always fail, regardless of which account is used. The account has been given access to the folder via NTFS file security.

Can help? Thanks.

hi,

sounds strange.
Are you using Windows 2003 or Windows 2000?
Are you refering to http based security? I mean do the users have to login with their user and pass first to access the password change website?

Hi,
Thanks for the reply. We are using Win 2K Server. On the server, we have 2 sites: One to serve the content and another one to serve account admin functionalities (e.g. change password, reset password). The second site does nothing but account administration using PaswordManager IIS. It does not require login to access (i.e. it has "everyone" under security).
The first site is served by Microsoft IIS via a web folder. Access is granted via the NTFS security (Right click on folder and select the security tab, then assign a particular user). That means, when you visit my site (e.g. http://ITD_NETIT), a small box will pop up and you will be required to key in the user account and password. I assume this is what you meant by http based security?
After a few months (third time), users will always fail to login at the small popup window. We checked and found nothing wrong with the account (not locked out, not disabled, password still valid, meets complexity requirement). It seems that the server's authentication component has failed to do its job.

Well... let's look at another cause: were there any changes to IIS configuration? In any case, make sure "basic authentication" is enabled in the IIS authentication modes. If you run with integrated security, this is more secure, but you need IE in order to access the site. At least for troubelshooting, "basic authentication" is a better choice?

Rainer