Announcement

Collapse
No announcement yet.

Exchange showing lots of failed logins from one user account

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Exchange showing lots of failed logins from one user account

    I'm getting alot of 529 errors from one user on my exchange '03 server.

    The user isn't knowingly doing anything wrong, and the volume of failed logins is such that it's not possible to login that many times in a two minute time span, were talking 150+ failed logins. The account is not getting locked out either.

    Does anyone know what could cause this behavior?

    Here's the event viewer entry:

    Date: 6/19/2008 Source: Security
    Category: Logon/Logoff
    Type: Failure Audit Event ID: 529
    User: NT Authority\SYSTEM
    Computer: Exchange

    Description
    -------------------
    Logon Failure
    Reason Unknown username or bad password
    User Name: btatro
    Domain:
    Logon Type: 3
    Logon Process: Advapi
    Authentication Package
    Microsoft_authentication_package_v1_0
    Workstation name: exchange
    Caller Username: exchange$
    Caller domain: BOW
    Caller Logon ID: (0x0,0x3e7)
    Caller Process ID: 4328
    Transited Services: -
    Source Network Address: -
    Source Port: -

  • #2
    Re: Exchange showing lots of failed logins from one user account

    A quick google implied that it could be an automated task running on the machine. ADVAPI is used to automate logons so I would check their machine for anything running or scheduled. Possibly active sync too? Only a guess though.
    cheers
    Andy

    Please read this before you post:


    Quis custodiet ipsos custodes?

    Comment


    • #3
      Re: Exchange showing lots of failed logins from one user account

      Hi,

      what if you unplugged his machine from network and check

      rgds

      Comment

      Working...
      X