IIS 401 Error — Unauthorized Access Attempt

WebServerErrors IIS Brute Force / Authentication Bypass

What This Means

Diagnose IIS HTTP 401 Unauthorized errors. Learn how to detect brute force attacks, misconfigured authentication, and credential theft targeting your IIS web applications.

Example Log

2026-03-08 14:22:31 W3SVC1 WEB01 10.0.1.50 GET /admin/dashboard - 443 - 185.220.101.42 Mozilla/5.0+(compatible;+MSIE+10.0) - 401 2 5 1250

Indicators of Suspicious Activity

How to Investigate

  1. Parse IIS logs and group 401 errors by client IP (c-ip) and target URI (cs-uri-stem)
  2. Check the 401 sub-status code to determine the specific failure reason
  3. Correlate with Windows Security Event 4625 for the same timeframe
  4. Identify which user accounts are being targeted
  5. Review the User-Agent strings for automated tooling signatures
  6. Check if any 401 sequences transition to 200 (successful compromise)

Recommended Mitigations

Scan This Log Instantly

Paste a suspicious log line below and get an instant AI-powered security assessment.

0 / 2000

Need a Full Investigation?

Scan entire log files, detect attack patterns, reconstruct timelines, and generate a full investigation report.

Run Smart Scan

Related Log Types

IIS 403 Error — Forbidden Access Denied IIS 500 Error — Internal Server Error IIS 404 Error — Page Not Found

Related Attack Patterns

Brute Force Attack Log Analysis Credential Stuffing Attack Logs Admin Login Attack Detection

Frequently Asked Questions

What does a 401 error in IIS mean? ▼
HTTP 401 means the server requires authentication that the client did not provide or provided incorrectly. IIS sub-status codes (401.1 through 401.5) give specific reasons such as logon failed, logon denied by policy, or authorization filter denied.
How can I find which accounts are being targeted? ▼
IIS logs include the cs-username field when authentication is attempted. Filter your logs for sc-status=401 and group by cs-username to see which accounts attackers are targeting.
What is the difference between 401 and 403 in IIS? ▼
401 means the client has not authenticated (or authentication failed). 403 means the client is authenticated but does not have permission to access the resource. Both can indicate security issues but have different root causes.