I finally figures it out via brute force (search the drive for the user
name). It turned out that it was an application pool that was using the
"bad" user.
"Dennis Grinberg" <dgrin_bli_luef.DeleteThis@bli_luef.bellatlantic.net> wrote in
message news:eUIndNVsEHA.1336@tk2msftngp13.phx.gbl...
>A clarification: we don't get the error when we enter
>C:\WINDOWS\System32\svchost.exe -k iissvcs (although it still doesn't
>work). We do get the error when try iisreset /restart.
>
>
> "Dennis Grinberg" <dgrin_bli_luef.DeleteThis@bli_luef.bellatlantic.net> wrote in
> message news:%23N$lHMVsEHA.2940@tk2msftngp13.phx.gbl...
>> Our World Wide Web Publishing Servce is set up to log on as Local System
>> Account. But when we start the service (or start it manually with
>> C:\WINDOWS\System32\svchost.exe -k iissvcs) it fails with a Failure Audit
>> in the Event Log showing that there was an attempt to logon (via Advapi)
>> with a completely different username (not Local System Account). We once
>> had a user with this other username, but we can not find a single service
>> that lists that username now.
>>
>> Does anyone have any suggestions on how to track this down?
>>
>> Thanks.
>>
>
><!-- ~MESSAGE_AFTER~ -->
>> Stay informed about: World Wide Web Publishing Service fails