IIS logs showing wrong user name in cs-username field

Question

User769474054 posted

Hi,

IIS logs show the user as <domain>\ds_<myusername> while it should to be <domain>\<myusername>. the ds_ account was an admin on the hosting machine and the site uses Windows Authentication. However I expect IIS to authenticate with Windows credentials <domain>\<myusername>. The app pool is running under App Pool Identity. I am not sure from where the IIS takes the user identity, but for other user who uses the website it uses the correct user name <domain>\<username>. 

what am I missing in my IIS configuration for the website?

Answer 1

User283571144 posted

Hi pavanlalit,

According to your description, I couldn't directly find the reason why it shows this user name.

Could you please tell me which log you have used?

How you enable the log for special user?

If you could post more details information, it will be more easily for us to find the reason.

Best Regards,

Brando

Answer 2

User769474054 posted

Hi Brando,

I used the IIS logs for the website  which shows in IIS UI in Logging Section as below.

I did not enable the logging for this special user. This special user account is an admin account which is used to administer the hosting server of the site. The site is looking for that special user account when I try to access the site from my machine where it should look for my actual user name. But for everyone else who is accessing the site, the IIS logs shows their correct user name with which they are accessing the website. not sure what am I missing.

Please let me know what extra info you need to look into this.

Thanks,

Pavan.

Answer 3

User753101303 posted

Hi,

"was" that is? The old account ds_username account was renamed to username? If yes it could be a caching issue : https://support.microsoft.com/en-us/help/946358/the-lsalookupsids-function-may-return-the-old-user-name-instead-of-the