Today, my intranet became unavailable for about 2 hours due to an unauthorized change to the web.config file. The change commented out some settings at the end that sets windows auth and points towards the AD auth file called windowssignin.aspx.

Once we figured out the cause, we restored a slightly older copy of the web.config file and the site came back up.

I logged in and looked at the event viewer and there were no entries to site changes.

We're looking at log files to see if anyone gained access to the server. In the meantime I thought I'd post this in case anyone had a similar issue (malicious or otherwise) and could shed some light on how it happened.

Thanks,
Mark