| Event Id | 14 |
| Source | Microsoft-Windows-IIS-FTP |
| Description | User %1 denied access to the current directory %2 due to a security change. |
| Event Information | According to Microsoft : Cause : This event is logged when User denied access to the current directory due to a security change. Resolution User status information The event log message is informational regarding user status; no action is required. Verify : To verify that FTP information is being logged, use the following procedures to find the FTP log file path and then create a test log. To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority. Find the FTP log file path by using Internet Information Services (IIS) Manager To find the FTP log file path: 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) 6.0 Manager and select Run as administrator . 3.Expand the server node, then expand FTP Sites . Select the FTP site for which you want to find the log file path. 4.Right click the FTP site and select Properties . 5.On the FTP Site tab, under Active log format , click Properties . 6.On the General tab, note the value for Log file directory . The default value is %Windir%\LogFiles . 7.Click Cancel , then click Cancel again. Create a test log To create a test log, you will need to enable logging, browse the FTP site, and then stop and start the FTP service. Enable logging To enable logging: 1.Click Start , click Control Panel , and then click Administrative Tools. 2.Right-click Internet Information Services (IIS) 6.0 Manager and select Run as administrator. 3.Expand the server node, then expand FTP Sites. Select the FTP site for which you want to create a test log. 4.Right-click the FTP site and select Properties . 5.On the FTP Site tab, make sure that the Enable logging check box is selected, then click OK. Browse the FTP site To browse the FTP site: 1.In the IIS 6.0 Manager, right-click the FTP site and select Browse. Stop and start the FTP service To stop and start the FTP service: 1.Open an elevated Command Prompt window. Click Start , point to All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator. 2.Type net stop msftpsvc. 3.Type net start msftpsvc. Verify that an FTP log file has been created To verify that an FTP log file has been created: 1.Using Windows Explorer, navigate to the log file directory you noted earlier. A folder with a name similar to MSFTPSVC1 should exist. 2.Open the folder. An FTP log file that has a .log or .ibl extension should have been created. 3.Check the date and time of the log file to verify that it was created within the last few minutes. |
| Reference Links | Event ID 14 from Source Microsoft-Windows-IIS-FTP |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.