Event ID - 13

Event Id13
SourceMicrosoft-Windows-IIS-FTP
DescriptionUser %1 failed to log on, could not access the home directory %2.
Event InformationAccording to Microsoft :
Cause :
This event is logged when user failed to logon and could not access the home directory.
Resolution :
User status information
The event log message is informational regarding user status; no action is required.
Verify :
To verify that FTP information is being logged, use the following procedures to find the FTP log file path and then create a test log.
To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.
Find the FTP log file path by using Internet Information Services (IIS) Manager
To find the FTP log file path:
1.Click Start , click Control Panel , and then click Administrative Tools .
2.Right-click Internet Information Services (IIS) 6.0 Manager and select Run as administrator .
3.Expand the server node, then expand FTP Sites . Select the FTP site for which you want to find the log file path.
4.Right click the FTP site and select Properties .
5.On the FTP Site tab, under Active log format , click Properties .
6.On the General tab, note the value for Log file directory . The default value is %Windir%\LogFiles .
7.Click Cancel , then click Cancel again.
Create a test log
To create a test log, you will need to enable logging, browse the FTP site, and then stop and start the FTP service.
Enable logging
To enable logging:
1.Click Start , click Control Panel , and then click Administrative Tools.
2.Right-click Internet Information Services (IIS) 6.0 Manager and select Run as administrator.
3.Expand the server node, then expand FTP Sites. Select the FTP site for which you want to create a test log.
4.Right-click the FTP site and select Properties .
5.On the FTP Site tab, make sure that the Enable logging check box is selected, then click OK.
Browse the FTP site
To browse the FTP site:
1.In the IIS 6.0 Manager, right-click the FTP site and select Browse.
Stop and start the FTP service
To stop and start the FTP service:
1.Open an elevated Command Prompt window. Click Start , point to All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator.
2.Type net stop msftpsvc.
3.Type net start msftpsvc.
Verify that an FTP log file has been created
To verify that an FTP log file has been created:
1.Using Windows Explorer, navigate to the log file directory you noted earlier. A folder with a name similar to MSFTPSVC1 should exist.
2.Open the folder. An FTP log file that has a .log or .ibl extension should have been created.
3.Check the date and time of the log file to verify that it was created within the last few minutes.
Reference LinksEvent ID 13 from Source Microsoft-Windows-IIS-FTP

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.