It seems that the access that provides the errors are made by the server itself. xxx.xxx.xxx.xxx is the IP of the server.
Code:
2008-08-13 09:00:04 W3SVC1720207907 xxx.xxx.xxx.xxx POST /SharedServices1/PSI/Authentication.asmx - 56737 - xxx.xxx.xxx.xxx Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 401 1 0
2008-08-13 09:00:04 W3SVC1720207907 xxx.xxx.xxx.xxx POST /SharedServices1/PSI/Authentication.asmx - 56737 PROJECT-SERVER\Administrador 158.42.24.39 Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 200 0 0
2008-08-13 09:00:04 W3SVC1720207907 xxx.xxx.xxx.xxx POST /SharedServices1/PSI/Authentication.asmx - 56737 - xxx.xxx.xxx.xxx Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 401 1 0
2008-08-13 09:00:04 W3SVC1720207907 xxx.xxx.xxx.xxx POST /SharedServices1/PSI/Authentication.asmx - 56737 PROJECT-SERVER\Administrador xxx.xxx.xxx.xxx Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 200 0 0
I had previous errors ( I posted them to this forums ) with "which services are runned by who" but I though they were solved...
According to the IIS Logs, the account Administrador is trying to login with a Mozilla browser, but I'm sure no one has the Administrator account password, and I'm also sure I was not browsing the PWA at the time the error was reported. There is an updated Firefox installed at the server, but it is not used to access PWA, and the version of Internet Explorer is 7 and causes no errors when login in.
Do we have a ghost in the shell? Any brilliant idea?
Thanks!
Update:
hmmmm... I think I'm getting closer:
Code:
2008-08-13 09:00:04 W3SVC746553835 xxx.xxx.xxx.xxx GET /PWA/_layouts/AccessDenied.aspx Source=http%3A%2F%2Furl%2Eof%2Ethe%2EPWASERVER%3Aport%2Fpwa%2Ftasks%2Easpx 12345 PROJECT-SERVER\Sh.Serv.Search xxx.xxx.xxx.xxx Mozilla/4.0+(compatible;+MSIE+4.01;+Windows+NT;+MS+Search+5.0+Robot) 200 0 0
This is the user that runs the Shared Services Search service. I didn't manage to get it working properly and It caused several errors while running as a service account or Administrator Account... It is probable that the error is caused by a missconfiguration of this service, but I'm still concerned about the randomness of the error.
Damn you, Search Service!