none
Event ID 4625 - unknown username or bad password RRS feed

  • Question

  • Exchange 2007

    I get a lot of "Event ID 4625 - unknown username or bad password" from IMAP4 (Caller Process Name: C:\Program Files\Microsoft\Exchange Server\ClientAccess\PopImap\Microsoft.Exchange.Imap4.exe)

    From what I can see (usernames tried) this is outside brute force attempts to get credentials.

    My problem:

    No source IP address listed (so I can block it on the firewall). On another server with RDP exposed to the Internet, I was able to change config so the IP is included in the event log. Could not find anything for Microsoft.Exchange.Imap4.exe (or pop3 for that matter).

    Any solutions?

    Best regards,

    Z.


    mjda




    • Edited by Manuel Alves Tuesday, September 18, 2018 11:22 AM
    Tuesday, September 18, 2018 11:19 AM

Answers