Event ID 4625 - unknown username or bad password RRS feed

  • Question

  • Exchange 2007

    I get a lot of "Event ID 4625 - unknown username or bad password" from IMAP4 (Caller Process Name: C:\Program Files\Microsoft\Exchange Server\ClientAccess\PopImap\Microsoft.Exchange.Imap4.exe)

    From what I can see (usernames tried) this is outside brute force attempts to get credentials.

    My problem:

    No source IP address listed (so I can block it on the firewall). On another server with RDP exposed to the Internet, I was able to change config so the IP is included in the event log. Could not find anything for Microsoft.Exchange.Imap4.exe (or pop3 for that matter).

    Any solutions?

    Best regards,



    • Edited by Manuel Alves Tuesday, September 18, 2018 11:22 AM
    Tuesday, September 18, 2018 11:19 AM