Once you get the failure Audit in Event Viewer, scroll up in the WinDBG window to see the time when the problem happend and if you see a stack like the following it will just confirm that the failure is coming from exchange.Įxps!CExchAuthContext::HrCheckClearTextLogin+0x1afĮxps!CExchAuthContext::HrServerNegotiateClearTextAuth+0xb6Įxps!CExchAuthContext::HrServerNegotiateAuth+0x18Įxps!CSessionContext::OnEXPSInNegotiate+0x14aĮxps!CSessionContext::OnSmtpInCallback+0x2ae You will still be able to debug the process but the function names will not be correct)Īfter that wait for some time till the problem happens. (You should be able to connect to Internet from the machine where you are Debugging as WinDBG goes to to download the PDB files for the DLL's. In other words what this means that InetInfo is waiting for you to do something and once you are done only then it will be able to proceed.Īfter that run the following commands one by one.Ģ) bp ADVAPI32!LogonUserA "k 100. NOTE: The moment you do this you have stopped InetInfo and every execution is blocked. After that select InetInfo.exe from the list.
INETINFO EXE PORT 80 INSTALL
To find out the code, we can use the Debugging Tools For Windows - Install them on your machine and after install just attach to InetInfo.exe (you can attach to a process by going to WinDBG and then selecting File -> Attach to Process.
INETINFO EXE PORT 80 CODE
The code which is generating these events is calling one of these functions for sure. The function on which you can concentrate on for now are LogonUser, LogonUserA, LogonUserExW and LogonUserExA. ADVAPI is the DLL for advanced Windows api's and is used in a lot of OS related code. The interesting thing to note here is that the Logon Process is ADVAPI. If yes then read further.If no you might be able to use some troubleshooting steps from this blog entry. The process id 2464 is determined to be InetInfo. Proceed further only if you see the above text in bold in the event viewer entry. Reason: Unknown user name or bad password In a lot of cases I saw this was happening in less than 30 seconds. After some time the account listed in the failure audit just gets locked out and you have to go and unlock the account very frequently. You keep on getting these failure audits in your event viewer and you dont konw why they are coming. You will run in to this issue only if you have Exchange/SMTP running on the machine. Unknown username or bad password - InetInfo.exe – ADVAPIĪ few days back I worked on a very interesting case and when I searched on Internet I found that a lot of people are running in to the same problem which prompted me to write this blog entry.
0 kommentar(er)
