Announcement

Collapse
No announcement yet.

Win NT Server - MSExchange Success Audits in Event Viewer

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Win NT Server - MSExchange Success Audits in Event Viewer

    I am experiencing some unusual logs in the event viewer. (NT Server running Exchange 5.5, very outdated, I know!!)
    Various success audits in the event viewer, event source 'MSExchangeIS Private' and event category 'logons' occurs during the course of the day. These happen at random times, and can occur about 50 times daily.
    I suspect it is something innocent, perhaps something to do with services. No one has physical access to the server, it is behind a good firewall, and I can be certain that it is not being connected to by unauthorised sources. It is also happening when no one is in the office, and no users have access to their, or other mailboxes.
    Please see the attached file for details of the logs.
    Anyone come across this, or have any ideas?
    Regards
    Larry
    Attached Files

  • #2
    the logon audit is enabled..
    nothing wrong with it....
    Marcel
    Technical Consultant
    Netherlands
    http://www.phetios.com
    http://blog.nessus.nl

    MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
    "No matter how secure, there is always the human factor."

    "Enjoy life today, tomorrow may never come."
    "If you're going through hell, keep going. ~Winston Churchill"

    Comment


    • #3
      Audit enabled

      Hi

      Thanks for your reply. The problem is that the event viewer is saying that these mailboxes are being opened on the exchange server (not the workstations) at these times, which is not physically happening.

      Larry

      Comment


      • #4
        IIRC the service account can open mailboxes e.g. to remove expired deleted items (probably other examples) so the entries are legitimate

        Tom
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment

        Working...
        X