Persistent 401 error after WebDav activity
I have experienced 3 instances where the home page of a website "spotaneiously" stopped working and started generating 401 errors.
The problem can be cleared by recycling the application pool.
Looking at the log file, the problem is apparently triggered by WebDav activity ( see extract from log file below ).
The attempted WebDav requests ( some kind of hack attempt I presume ) fail, but the error condition persists.
Apparently a bug in IIS I think. Is there a fix for this?
Thanks
( Log file shown below - see 401 error on GET - this persists )
2011-01-31 00:41:07 109.228.16.135 OPTIONS / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 200 0 0 187
2011-01-31 00:41:07 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 171
2011-01-31 00:41:07 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 140
2011-01-31 00:41:08 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 218
2011-01-31 00:41:08 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 140
2011-01-31 00:41:08 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 156
2011-01-31 00:41:08 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 140
2011-01-31 00:41:08 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 156
2011-01-31 00:41:08 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 156
2011-01-31 00:41:10 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 140
2011-01-31 00:41:10 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 156
2011-01-31 00:41:10 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 0 171
2011-01-31 00:41:10 109.228.16.135 PROPFIND / - 80 - 62.40.58.90 Microsoft-WebDAV-MiniRedir/6.1.7600 401 0 64 156
2011-01-31 00:41:40 109.228.16.135 GET / - 80 - 95.175.150.150 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+WOW64;+GoogleT5;+SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+Media+Center+PC+5.1;+VER#69#80837670506745484954484871;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30618)
401 0 0 15
January 31st, 2011 10:13am
I'd ask them here.
http://www.iis.net/
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Free Windows Admin Tool Kit Click here and download it now
January 31st, 2011 10:34am
I just realised that the WebDav operations are not a hacking attempt, instead the IP address had downloaded a word document from the site a few minutes before, so the WebDav operations are probably an attempt to save changes ( or to query the server to
see if such an operation is allowed ). This attempted save has the side effect of killing the home page of the website until the application pool is re-cycled. Is there some page-specific (but not HTTP verb specific) error limit that will shut down a page
after some number of errors?
February 2nd, 2011 3:05am