Multiple logon failures in Exchange Server 2007 event log ID 4625 after applying latest Microsoft updates
After applying the latest round of updates to our Exchange 2007 server (Windows 2008 SP2) we immediately started receiving errors like the one below. These correspond to requests by Outlook for users' logon credentials which also are rejected despite being users' valid domain credentials.Local users, ie not those using Outlook Anywhere, are able to continue working in Outlook by simply clicking Cancel when logon is requested.Howerver, they are frequently pestered by logon prompts.Note that patches were applied while on Exchange 2007 SP1 but haveupdated it to SP2 in an effort to fix this issue--No improvement noted.How do I get the logon process functioning again?Thank you.Error Text from Exchange Server's Security Event Log:An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: (ValidUsersID) Account Domain: (DomainName) Failure Information:Failure Reason: Domain sid inconsistent.Status: 0xc000006dSub Status: 0xc000019b
December 16th, 2009 12:49am

Have a look at post http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/0c94187d-bc97-4fa5-9413-e8762a25a360as the problem is very similar, except we aren't seeing any logon failures in the Security logs, just continual prompts for credentials (that can be canceled and still have access to email). Outlook Anywhere is working OK.
Free Windows Admin Tool Kit Click here and download it now
December 16th, 2009 3:10am

Outlook 2007 prompts you repeatedly for a password under certain network conditionshttp://support.microsoft.com/kb/956531
December 17th, 2009 12:19pm

Unlike the symptoms of this article, my users have never actually been locked out or off-lined. Indeed if they simply select Cancel at the log on prompt (5-6 times) they are able to Send/Receive without error until the logon prompt returns several minutes later at which time this process can be repeated.I tried this anyway and it does block the prompts in Outlook but it seems to only hide the errors from the users as the errors are still being logged on the Exchange server and to date I have over 6000 logged. While this masking of the issue may seem sufficient, we have an Access application that uses the builtin email function, which was also broken by the updating process, and it continues to be broken.
Free Windows Admin Tool Kit Click here and download it now
December 18th, 2009 7:21am

Thank you for the referral. However, I tried this on my Exhange 2008 SP2 Standard server without succes.
December 18th, 2009 7:26am

After many hours with MS support the problem was fixed for internal access by running: setspn -a http/mail.mydomain.com SRVEXCH01Unfortunately Outlook Anywhere is still down for external users if Windows Authentication is used. It works for Basic Authentication but this causes local users to be prompted for their credentials, though only once.Note that for external users the error event 4625 originally described in this post still occur for each external logon attempt and testing with https://www.testexchangeconnectivity.com/Default.aspx shows the issue is occurs during a windows authentication error in IIS 7.Now I am trying to figure out what the latest round of MS patches did to prevent external users from logging on to the RPC and Autodiscover web pages.
Free Windows Admin Tool Kit Click here and download it now
December 23rd, 2009 6:45am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics