This is an odd one that I've been trying to track down for while.
I am not a server administrator, but a programmer/developer, but, sadly, at my company, I probably have the most knowledge of how to manage a server like this. So, I've been researching it.
We have a pretty simple server setup running Windows Server 2003 R2 Standard Service Pack 2/IIS6. It has two basic functions: a web server and SFTP server.
We are using a very old SFTP software package - GlobalScape SecureFTP Server 3.3.0. This FTP software has been running fine for years and it only has a handful of user accounts (maybe 10-15). Recently, though, seemingly out of the blue, it's been crashing every day, many times each day (anywhere between 10-25 times a day).
My first step was to look at the event viewer to see if there was any additional information I could find. I noticed that another program was logging in/out of the Administrator account at about the same time that the program crashed - every time. This program is replication software - DoubleTake - that keeps the files on this server in sync with a backup server. So, I suggested that the program be changed to not use the main Administrator account. That change was made a few days ago, but the crashes started occuring again.
So, I went back to the Event Viewer....
Now, I'm seeing the following Event in the Security Log occurring every time at the exact same time that the SFTP application crashes (I've obscured the user names below for security purposes):
Source: Security
Category: Privilege User
Type: Success A
User: NT AUTHORITY\SYSTEM
Privileged Service Called:
Server: NT Local Security Authority / Authentication Service
Service: LsaRegisterLogonProcess()
Primary User Name: XXXXXXX
Primary Domain: WORKGROUP
Primary Logon ID: (0x0,0x3E7)
Client User Name: XXXXXXX
Client Domain: WORKGROUP
Client Logon ID: (0x0,0x3E7)
Privileges: SeTcbPrivilege
Can anyone give me a clue as to what is happening and possibly who to resolve this?
FYI, there is a plan in place to upgrade the FTP software, but, in the meantime, I need this to work as it was just a few weeks ago....
