Security logs
I am extremely new to Exchange 2007, and I have been looking at the logs on the server and have noticed that the Security log is full of failures. The failures are occuring every 30 seconds and in pairs. Below is what I copied from the log. Any help would be great.
An account failed to log on.
Subject:Security ID: SYSTEMAccount Name: SERVERNAME$Account Domain: DOMAINNAMELogon ID: 0x3e7
Logon Type: 3
Account For Which Logon Failed:Security ID: NULL SIDAccount Name: SERVERNAME$Account Domain:
Failure Information:Failure Reason: Unknown user name or bad password.Status: 0xc000006dSub Status: 0xc0000064
Process Information:Caller Process ID: 0xaf0Caller Process Name: C:\Program Files\Microsoft\Exchange Server\Bin\Microsoft.Exchange.Search.ExSearch.exe
Network Information:Workstation Name: SERVERNAMESource Network Address: -Source Port: -
Detailed Authentication Information:Logon Process: Advapi Authentication Package: NegotiateTransited Services: -Package Name (NTLM only): -Key Length: 0
September 4th, 2009 4:11pm
Have you applied any recent patches? or are you experiencing any performance issues? These are all the normal event which occurs when user login to Outlook with bad password or password expiresVinod
|CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|
Free Windows Admin Tool Kit Click here and download it now
September 4th, 2009 4:41pm
I understand that but it appears that th user is the system user, and I have not applied any updates recently. BTW Outlook users are kicked off frequently and asked for passwords.
September 4th, 2009 5:22pm
I would run EXBPA and scan the Health of server. http://www.microsoft.com/downloads/details.aspx?FamilyID=DBAB201F-4BEE-4943-AC22-E2DDBD258DF3&displaylang=en Vinod
|CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|
Free Windows Admin Tool Kit Click here and download it now
September 4th, 2009 5:25pm