Here's my scenario 1. User running XP SP2 fully patched 2. Running Outlook 2007 connecting to Windows 2003 Exchange server (Exchange 2007), Windows 2008 domain In the past week or so we have seen a couple of users that are showing up on our logon failure reports. Looking at the logon failure events we can see that the users are trying to logon to our Exchange server with a login type of 3 (Network). Our thought is that these are coming from the Outlook client. There are numerous consecutive events in the span of a minute. The number of logon errors is greater than our account lockout policy yet the users aren't getting locked out. Other account lockouts (e.g. interactive at workstations) lock out the accounts appropriately. Am I correct that even the Outlook client would lock out an account if it couldn't reach the Exchange server because of a password issue? Has anyone else seen this? Why wouldn't the account get locked out? Thanks for any help

On Wed, 19 Jan 2011 18:52:52 +0000, Snowmizer wrote: > > >Here's my scenario > >1. User running XP SP2 fully patched 2. Running Outlook 2007 connecting to Windows 2003 Exchange server (Exchange 2007), Windows 2008 domain > >In the past week or so we have seen a couple of users that are showing up on our logon failure reports. Looking at the logon failure events we can see that the users are trying to logon to our Exchange server with a login type of 3 (Network). Our thought is that these are coming from the Outlook client. There are numerous consecutive events in the span of a minute. The number of logon errors is greater than our account lockout policy yet the users aren't getting locked out. Other account lockouts (e.g. interactive at workstations) lock out the accounts appropriately. > >Am I correct that even the Outlook client would lock out an account if it couldn't reach the Exchange server because of a password issue? Has anyone else seen this? Why wouldn't the account get locked out? Regardless of the software, this is a Windows, not Exchange problem. What I can tell you is that if the password is one of the last two changes, then failures are recorded but don't count towards the lockout count. Failures with the current password , or with a password from three (or more) changes ago, will cause a lockout. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Could you provide the logon failure event that you encountered? Could you reproduce the failure event, by launching outlook and entering the wrong credential? James Luo TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

My guess is that since it doesn't happen everyday it's because of password changes. Thanks for explaining how the lockout count works. I wasn't aware of this item.