1

This is an odd one that I've been trying to track down for while.

I am not a server administrator, but a programmer/developer, but, sadly, at my company, I probably have the most knowledge of how to manage a server like this. So, I've been researching it.

We have a pretty simple server setup running Windows Server 2003 R2 Standard Service Pack 2/IIS6. It has two basic functions: a web server and SFTP server.

We are using a very old SFTP software package - GlobalScape SecureFTP Server 3.3.0. This FTP software has been running fine for years and it only has a handful of user accounts (maybe 10-15). Recently, though, seemingly out of the blue, it's been crashing every day, many times each day (anywhere between 10-25 times a day).

My first step was to look at the event viewer to see if there was any additional information I could find. I noticed that another program was logging in/out of the Administrator account at about the same time that the program crashed - every time. This program is replication software - DoubleTake - that keeps the files on this server in sync with a backup server. So, I suggested that the program be changed to not use the main Administrator account. That change was made a few days ago, but the crashes started occuring again.

So, I went back to the Event Viewer....

Now, I'm seeing the following Event in the Security Log occurring every time at the exact same time that the SFTP application crashes (I've obscured the user names below for security purposes):

Source: Security
Category: Privilege User
Type: Success A
User: NT AUTHORITY\SYSTEM

Privileged Service Called:
    Server:     NT Local Security Authority / Authentication Service
    Service:        LsaRegisterLogonProcess()
    Primary User Name:  XXXXXXX
    Primary Domain: WORKGROUP
    Primary Logon ID:   (0x0,0x3E7)
    Client User Name:   XXXXXXX
    Client Domain:  WORKGROUP
    Client Logon ID:    (0x0,0x3E7)
    Privileges: SeTcbPrivilege

Can anyone give me a clue as to what is happening and possibly who to resolve this?

FYI, there is a plan in place to upgrade the FTP software, but, in the meantime, I need this to work as it was just a few weeks ago....

3
  • Does the program generate any sort of log or message that it crashed? Or does it simply disappear from the process list with no explanation or dump file? – Nathan C Dec 15 '14 at 20:00
  • Just clarifying a point- you said you implimented the change to stop using the Admin acct with DoubleTake, did the SFTP software work as expected for awhile and then break, or did it just continue to crash? Also, did the NTAuthority/system entry occur before you changed the acct used by DoubleTake? – Kate Dec 16 '14 at 0:19
  • @NathanC I see the crash in the System Event Log, and I receive an alert that it crashed every time I log on to the machine. – Eric Belair Dec 16 '14 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.