Hello, I noticed that my Domain Controller is heavily hit by the mailbox used for brick level backups for preservation. I have 320,000 hits in the security log within 10 minutes. 1. is it usual for 20,000 mailboxes? 2. is it possible to prevent this load from only one mailbox? I saw this: "You can also schedule the Exmerge utility to run regularly against specific mailboxes and perform incremental backups of a mailbox's contents to a single .pst file. Although this backup method might not be feasible for a large number of users, if you perform this type of "brick" level backup, it can help you restore data even more quickly for critical users or folders. Refer to the Exmerge utility documentation for information about backup scheduling." But what is "a large number of users"? Thanks, Dom System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

any recommendations?System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

What’s the exchange topology? Which tool do you use for backup? Please provide the event that appears repeatedly in the security logJames Luo TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx) If you have any feedback on our support, please contact tngfb@microsoft.com

Hello, Topology Exchange 2007 Service --> Exchange 2007 Organization (domain name) --> Site (MCO) --> ActiveSync Service (NCO) --> Client Access (Case Server1) --> Healthy --> ActiveSync Connectivity (Case Server 1 to Mailbox Server 1) (1to 5)ActiveSync Service (NCO) --> Client Access (Case Server1) --> Healthy --> A ... E --> ActiveSync Connectivity (Case Server 1 to Mailbox Server 6) + PF1 & PF2 + Common Case Server 1 + ExBpa Case Server 1 Same for IMAP Same for OWA Same for POP3 Then repeat for --> Client Access (Case Server2) --> Client Access (Case Server3) --> Client Access (Case Server4) Then Hub Service (MCO)/ IMAP4 Service (MCO)/ MAPI Service (NCO)/ OWA Service (MCO)/ POP3 Service (MCO)/ Web Services Service (MCO) Thanks, DomSystem Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

Hello, These are the two Event Codes logged: 03/23/10 01:59:49 AMLogName=SecuritySourceName=SecurityEventCode=538EventType=8Type=Success AuditComputerName=ADDCMCO3User=MailboxBUSid=S-1-5-21-73586283-1284227242-1801674531-193673SidType=1Category=2CategoryString=Logon/LogoffRecordNumber=440516584Message=User Logoff: User Name: MailboxBU Domain: AD Logon ID: (0x2,0xF9751A83) Logon Type: 3 host=addcmco3 ADDC Options sourcetype=WinEventLog:Security Options source=WinEventLog:Security Options 03/23/10 01:59:49 AMLogName=SecuritySourceName=SecurityEventCode=540EventType=8Type=Success AuditComputerName=ADDCMCO3User=MailboxBUSid=S-1-5-21-73586283-1284227242-1801674531-193673SidType=1Category=2CategoryString=Logon/LogoffRecordNumber=440516583Message=Successful Network Logon: User Name: MailboxBU Domain: AD Logon ID: (0x2,0xF9751A83) Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: Logon GUID: {f20aa4a6-019f-f347-34cb-f07ffbbcd0e7} Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 10.2.18.24 Source Port: 35296 host=addcmco3 ADDC Options sourcetype=WinEventLog:Security Options source=WinEventLog:Security Options This is happening on two domain controllers ADDCMCO3 and ADDCMCO1 Thanks, DomSystem Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

Apparently, you have configured an audit policy to audit successful logon and logoff events. For the method to verify the settings of audit policy, please use the “Security” forum which would be the best place for the questionJames Luo TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx) If you have any feedback on our support, please contact tngfb@microsoft.com

Hello, I do not see a "Security" forum as is? Is it under another category? Windows Servers? Forefront? Thanks,DomSystem Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 Support

It’s under the windows server category. I have put the link aboveJames Luo TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx) If you have any feedback on our support, please contact tngfb@microsoft.com