Running IIS 6 on a Windows 2003 box.
IIS would run for about a day and then IIS Admin and WWW Publishing
Service disable themselves. The Event Logs only show the information
message that they are being set from auto start to disable. I've
already applied all of the patches available from Microsoft.
Any ideas?
On Sep 28, 3:40 pm, xiongmaocub
> Running IIS 6 on a Windows 2003 box.
>
> IIS would run for about a day and then IIS Admin and WWW Publishing
> Service disable themselves. The Event Logs only show the information
> message that they are being set from auto start to disable. I've
> already applied all of the patches available from Microsoft.
>
> Any ideas?
No Microsoft software disables those services.
Sounds like you have personal security software like McAfee or Norton
which is intentionally disabling IIS.
Or maybe you have malware that is messing with your system
configuration.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
There aren't any firewalls blocking IIS.
And there shouldn't be any malware because it's a clean OS install
(I've already reinstalled the entire OS three times.)
On Sep 28, 11:22 pm, David Wang
> On Sep 28, 3:40 pm, xiongmaocub
>
> > Running IIS 6 on a Windows 2003 box.
>
> > IIS would run for about a day and then IIS Admin and WWW Publishing
> > Service disable themselves. The Event Logs only show the information
> > message that they are being set from auto start to disable. I've
> > already applied all of the patches available from Microsoft.
>
> > Any ideas?
>
> No Microsoft software disables those services.
>
> Sounds like you have personal security software like McAfee or Norton
> which is intentionally disabling IIS.
>
> Or maybe you have malware that is messing with your system
> configuration.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
Are you running any personal security software that is locking down
this server.
Or maybe Group Policy that is disabling certain services.
You are looking for custom code running with Administrative privileges
that is disabling Windows Services. I am not aware of any auditing to
figure this out -- auditing of administrators is inherently useless
since they have privileges to modify the audit log... and if you don't
trust something, don't let it be administrator.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
On Oct 1, 10:01 am, BruinCub
> There aren't any firewalls blocking IIS.
>
> And there shouldn't be any malware because it's a clean OS install
> (I've already reinstalled the entire OS three times.)
>
> On Sep 28, 11:22 pm, David Wang
>
>
>
> > On Sep 28, 3:40 pm, xiongmaocub
>
> > > Running IIS 6 on a Windows 2003 box.
>
> > > IIS would run for about a day and then IIS Admin and WWW Publishing
> > > Service disable themselves. The Event Logs only show the information
> > > message that they are being set from auto start to disable. I've
> > > already applied all of the patches available from Microsoft.
>
> > > Any ideas?
>
> > No Microsoft software disables those services.
>
> > Sounds like you have personal security software like McAfee or Norton
> > which is intentionally disabling IIS.
>
> > Or maybe you have malware that is messing with your system
> > configuration.
>
> > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > //- Hide quoted text -
>
> - Show quoted text -
Thanks for your insight David.
I removed the server from our domain and IIS was still running this
morning. So I rejoined the domain and after the reboot, the IIS
service was disabled. Now to find out where in the GP is the problem
since my predecessor was the one who initially set up the domain.
On Oct 1, 10:25 am, David Wang
> Are you running any personal security software that is locking down
> this server.
>
> Or maybe Group Policy that is disabling certain services.
>
> You are looking for custom code running with Administrative privileges
> that is disabling Windows Services. I am not aware of any auditing to
> figure this out -- auditing of administrators is inherently useless
> since they have privileges to modify the audit log... and if you don't
> trust something, don't let it be administrator.
>
> //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> //
>
> On Oct 1, 10:01 am, BruinCub
>
> > There aren't any firewalls blocking IIS.
>
> > And there shouldn't be any malware because it's a clean OS install
> > (I've already reinstalled the entire OS three times.)
>
> > On Sep 28, 11:22 pm, David Wang
>
> > > On Sep 28, 3:40 pm, xiongmaocub
>
> > > > Running IIS 6 on a Windows 2003 box.
>
> > > > IIS would run for about a day and then IIS Admin and WWW Publishing
> > > > Service disable themselves. The Event Logs only show the information
> > > > message that they are being set from auto start to disable. I've
> > > > already applied all of the patches available from Microsoft.
>
> > > > Any ideas?
>
> > > No Microsoft software disables those services.
>
> > > Sounds like you have personal security software like McAfee or Norton
> > > which is intentionally disabling IIS.
>
> > > Or maybe you have malware that is messing with your system
> > > configuration.
>
> > > //Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David. Wang
> > > //- Hide quoted text -
>
> > - Show quoted text -