I rebooted one of our Mailbox servers yesterday and ever since on our AD servers I'm getting an Event 4724- "An
attempt was made to reset an account's password" every three minutes."

I did find I had some health mailboxes corrupted and removed those from the OU in AD and restarted the health service again. The problem persisted. I then deleted the health mailbox causing the issue (which is on the rebooted server)- and restarted the  Health Serice- and the issue started again from the recreated health mailbox.

The mailbox in question is for the DAG active copy on that server. The other two passive copies of that Database have health mailboxes with no issue

Exchange reports full health- no issues whatsover. Any idea what is causing this?

• Edited by tonyholdgate Thursday, May 01, 2014 3:53 AM

Hi Tony

Just run the below command and check if there are any health mailboxes corrupted and if they are in inconsistent state in any of the mailbox servers.
Get-MailboxServer | Get-Mailbox -Monitoring | FT Alias,ServerName

I think Both authorized user account and processes can carry out this process of resetting the password
I would suggest you to stop and disable the Health Manager service on all the Exchange 2013 servers for mean time for testing.
After that you can monitor for couple of minutes to see if the events 4724 is getting generated just to isolate.

And mostly this event should be related to AD and DC rather than Exchange.

Probably the below link might be helpful for you to identify the problem again not a solution
http://blogs.technet.com/b/askds/archive/2010/06/11/friday-mail-sack-shut-up-laura-edition.aspx

Thanks Sathish

Yes I've already fixed the corrupted mailboxes so its not that. From the logs generated on the AD server I've tracked it down to a specific health mailbox account on a specific server- and it only started doing it after a reboot.

I'll disable the health api on that server to see if it stops but I'm fairly sure it will. If it does- then what?

Its the weekend here so I'll test monday

Hi Tony 

Try these suggestion too and i think you would be able to find the problem

First step is to run command "Get-MailboxServer | Get-Mailbox -Monitoring | FT Alias,ServerName" to see if there are any warnings related to health mailboxes. 

Also, you may want to check Managed availability with commands like : 
Get-HealthReport, Get-ServerHealth, Get-ServerComponentState and check Crimson logs found under Applications and Services Log\Microsoft\Exchange\ActiveMonitoring\ and   Applications and Services Log\Microsoft\Exchange\ManagedAvailability\ 

And I would suggest to check password policy configured in your domain, values of attributes like Minimum/Maximum Password Length, Minimum/ Maximum Password Age. If one mailbox server affected maybe you might need to run a gpupdate /force on that server

I think in your case the password policy is causing this trouble 

Let us know after  you check all the above 

Ok been through all of these- and all seemed ok. Then the error stopped occuring. No idea why but it has not happened in 24 hours

Its back

• Marked as answer by tonyholdgate Tuesday, May 06, 2014 11:20 PM
• Unmarked as answer by tonyholdgate Thursday, May 08, 2014 12:31 AM
• Edited by tonyholdgate Thursday, May 08, 2014 12:31 AM

OK- its jumped to another server- but that server was also rebooted last night - and thats when it started. Seems to settle down after a couple of days

• Marked as answer by tonyholdgate Thursday, May 08, 2014 2:06 AM
• Unmarked as answer by tonyholdgate Thursday, May 08, 2014 9:10 PM
• Marked as answer by tonyholdgate Thursday, May 08, 2014 9:10 PM

What do you do when they're corrupt?

I'm seeing:

"the following validation errors happened: " warning: Database is mandatory on UserMailbox"