iis security: Something happened to my Exchange server over the weekend that caused
a crash (nothing logged) and upon startup my IIS is failing with Event
ID 115 (Service could not bind instance 1). This error is logged for
both MSFTPSVC and W3SVC. All services seem to be running but OWA
access to either port 80 or 443 gets a page cannot be displayed error.
The access attempt is responded to with an account login and the logs
show the access attempt. I am running a certificate, and a port
redirection from port 80. Most docs I have found on this refer to
running multiple instances which I do not have. My securebindings in
metabase is correct. I have no other instances of either FTP or
W3SVC. This behaves exactly the same either on reboot or IIS Admin
restart. I have tried disabling SSL by removing port listener in
default web site properties and service behaves exactly the same so it
doesn't seem to be an SSL related problem.

Any suggestions greatly appreciated.

thanks

These two statements contradict each other:
1. "Service could not bind instance 1"
2. "... the [web service] logs show the access attempt"

If W3SVC could not bind instance 1, IIS is not going to respond to any
requests and is certainly not going to log any attempts.

So, either #1 is true and something ELSE is writing to the IIS log files, or
#2 is true and #1 is a red-herring.

I also wonder if you have been hacked and something is simply trying to
harvest username/password.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Something happened to my Exchange server over the weekend that caused
a crash (nothing logged) and upon startup my IIS is failing with Event
ID 115 (Service could not bind instance 1). This error is logged for
both MSFTPSVC and W3SVC. All services seem to be running but OWA
access to either port 80 or 443 gets a page cannot be displayed error.
The access attempt is responded to with an account login and the logs
show the access attempt. I am running a certificate, and a port
redirection from port 80. Most docs I have found on this refer to
running multiple instances which I do not have. My securebindings in
metabase is correct. I have no other instances of either FTP or
W3SVC. This behaves exactly the same either on reboot or IIS Admin
restart. I have tried disabling SSL by removing port listener in
default web site properties and service behaves exactly the same so it
doesn't seem to be an SSL related problem.

Any suggestions greatly appreciated.

thanks

Hal

Hi,

Try this article

http://support.microsoft.com/default.aspx?scid=kb;en-us;322023



[quoted text, click to view]