After you install the Microsoft Internet Information Services (IIS) management pack module that is available for Microsoft Operations Manager 2000 Service Pack 1 (SP1), the following security rules may not work correctly if you are using Microsoft IIS 5.0.

Note The name of the management pack module is "Internet Information Server (IIS) Management Pack Module."

•	Security: IIS Log: Error 401.1 - Logon failed
•	Security: IIS Log: Error 401.2 - Logon failed due to server configuration
•	Security: IIS Log: Error 401.3 - Unauthorized due to ACL on resource
•	Security: IIS Log: Error 401.4 - Authorization failed by filter

For example, if you generate an Error 401.1 error by using Microsoft Internet Explorer, Microsoft Operations Manager (MOM) 2000 does not report the error.

If you have W3C Extended Logging turned on in IIS 5.0, the following is logged in the IIS 5.0 log file:

...GET / - 401 5 4644 584 47 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
...GET / - 401 5 4246 1070 16 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
...GET / - 401 5 4246 1070 16 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
...GET / - 401 5 4246 1070 0 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -

Back to the top

This problem occurs because IIS 5.0 does not log the substatus code of the 401 error. When MOM 2000 reads the IIS 5.0 log file, "GET / - 401 5" is interpreted as a 401.5 error because the "5" is read as a separate parameter. By default, the OnePoint service does not alert on 401.0 and 401.5 errors.

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Back to the top

For additional information about the IIS management pack module that is available for MOM 2000 SP1, visit the following Microsoft Web site:

Back to the top