Home All Groups Group Topic Archive Search About

Security concern in event viewer

Author
14 Apr 2005 11:31 PM
Joe
I posted this in the Security General section also and was helped to a point
but then asked to come here for better assistance. Here goes:

Hello,

I am getting this in my event viewer every now and then.

The configuration information of the performance library
"C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
match the trusted performance library information stored in the registry. The
functions in this library will not be treated as trusted.

Event ID 2003

I am on  small AD DC internal DNS only with 2 PC's XP pro SP2
connected to a server 2003 ent. Machine.

any help would be geat!

This was my last reply from the newsgroup:

Joe,

As you are in need of IIS on the DC, and apparently an external
exposure, a situation not unlike those running Small Business Server,
you may want to post to the newgroup able to help you out with IIS
specifically
microsoft.public.inetserver.iis.security
The message is not normal and you should seek to resolve it.

Otherwise, I feel that your config can be run in an outward facing
exposure with safety.  It is however, more effort that using well-
hidden and stripped down DC and proxied IIS.  Staying current
with patches as you indicate is one very big component, but things
like making sure web content is securely written (ex. sql injection
etc.) also comes into play.  The guidance and best practices docs
on the MS web do provide guidance.  You might also benefit from
the SBS community (who will likely say, get behind a router-based
firewall device as step one).

Can anyone further help me here? Please?
Joe

Author
16 Apr 2005 12:05 PM
Insub
Try this KB -
Event ID 2003 Warning Message Logged When Loading Performance Counters
http://support.microsoft.com/kb/267831/EN-US/

Show quoteHide quote
"Joe" wrote:

> I posted this in the Security General section also and was helped to a point
> but then asked to come here for better assistance. Here goes:
>
> Hello,
>
> I am getting this in my event viewer every now and then.
>
> The configuration information of the performance library
> "C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
> match the trusted performance library information stored in the registry. The
> functions in this library will not be treated as trusted.
>
> Event ID 2003
>
> I am on  small AD DC internal DNS only with 2 PC's XP pro SP2
> connected to a server 2003 ent. Machine.
>
> any help would be geat!
>
> This was my last reply from the newsgroup:
>
> Joe,
>
> As you are in need of IIS on the DC, and apparently an external
> exposure, a situation not unlike those running Small Business Server,
> you may want to post to the newgroup able to help you out with IIS
> specifically
> microsoft.public.inetserver.iis.security
> The message is not normal and you should seek to resolve it.
>
> Otherwise, I feel that your config can be run in an outward facing
> exposure with safety.  It is however, more effort that using well-
> hidden and stripped down DC and proxied IIS.  Staying current
> with patches as you indicate is one very big component, but things
> like making sure web content is securely written (ex. sql injection
> etc.) also comes into play.  The guidance and best practices docs
> on the MS web do provide guidance.  You might also benefit from
> the SBS community (who will likely say, get behind a router-based
> firewall device as step one).
>
> Can anyone further help me here? Please?
> Joe
>
Author
17 Apr 2005 1:28 AM
Joe
Thanks very much

Joe

Show quoteHide quote
"Insub" wrote:

> Try this KB -
> Event ID 2003 Warning Message Logged When Loading Performance Counters
> http://support.microsoft.com/kb/267831/EN-US/
>
> "Joe" wrote:
>
> > I posted this in the Security General section also and was helped to a point
> > but then asked to come here for better assistance. Here goes:
> >
> > Hello,
> >
> > I am getting this in my event viewer every now and then.
> >
> > The configuration information of the performance library
> > "C:\WINDOWS\system32\inetsrv\w3ctrs.dll" for the "W3SVC" service does not
> > match the trusted performance library information stored in the registry. The
> > functions in this library will not be treated as trusted.
> >
> > Event ID 2003
> >
> > I am on  small AD DC internal DNS only with 2 PC's XP pro SP2
> > connected to a server 2003 ent. Machine.
> >
> > any help would be geat!
> >
> > This was my last reply from the newsgroup:
> >
> > Joe,
> >
> > As you are in need of IIS on the DC, and apparently an external
> > exposure, a situation not unlike those running Small Business Server,
> > you may want to post to the newgroup able to help you out with IIS
> > specifically
> > microsoft.public.inetserver.iis.security
> > The message is not normal and you should seek to resolve it.
> >
> > Otherwise, I feel that your config can be run in an outward facing
> > exposure with safety.  It is however, more effort that using well-
> > hidden and stripped down DC and proxied IIS.  Staying current
> > with patches as you indicate is one very big component, but things
> > like making sure web content is securely written (ex. sql injection
> > etc.) also comes into play.  The guidance and best practices docs
> > on the MS web do provide guidance.  You might also benefit from
> > the SBS community (who will likely say, get behind a router-based
> > firewall device as step one).
> >
> > Can anyone further help me here? Please?
> > Joe
> >