none
Event ID 1020 - Category SmtpReceive RRS feed

  • Question

  • Getting this error every few minutes about my local administrator account (not domain administrator) provided valid credentials but is not authorized to use this server, authentication failing.  Unable to add the local account using the MS-Exch-SMTP-Submit cmdlet...nor do I think it should need to be added, just want to get rid of the error.  No issues with mail flow at all, just an annoying event to keep popping up.  Thanks.


    Randy Oster

    Thursday, April 18, 2013 1:42 PM

Answers

  • You should enable logging on the SMTP connector and see where the attempt is coming from.  It could be an incorrectly configured program trying to send out email notifications or worse a malicious program trying to send spam.  If you have any pop/imap/smtp accounts configured anywhere, verify that the outgoing server settings are correct.
    Thursday, April 18, 2013 6:58 PM
  • I think I found the server that was trying to send out using that account.  Enabling verbose helped me isolate the machine....thanks for all your help. 

    Randy Oster

    Friday, April 19, 2013 7:36 PM

All replies

  • You should enable logging on the SMTP connector and see where the attempt is coming from.  It could be an incorrectly configured program trying to send out email notifications or worse a malicious program trying to send spam.  If you have any pop/imap/smtp accounts configured anywhere, verify that the outgoing server settings are correct.
    Thursday, April 18, 2013 6:58 PM
  • We are definitely not spamming, so I don't think that's the cause of the issue.  We are not using POP, only use IMAP internally (blocked at our firewall from going out) for our phones voicemail system to sync up voicemail deletion from outlook to the voicemail system.  I have logging set to the highest level for the ms-exchange-transport smtp receive, but nothing other than that generic warning is coming in, no more details. 

    Randy Oster

    Friday, April 19, 2013 7:03 PM
  • You need to enable verbose logging on the SMTP receive connectors and check the log file in the exchange server directory.  That will give you IP addresses of where the attempts are coming from.

    Friday, April 19, 2013 7:13 PM
  • I think I found the server that was trying to send out using that account.  Enabling verbose helped me isolate the machine....thanks for all your help. 

    Randy Oster

    Friday, April 19, 2013 7:36 PM