locked
Numerous failed logs on on exchange server 2010 appearing in security log of event viewer RRS feed

  • Question

  • Hello 

    I have a situation where i am seeing thousands of failed logons on my exchange server event viewer security log. I cannot identify what is causing this despite of going through several articles online and investigating.

    if someone could assist , i would be grateful

    The details of the event are as below

    An account failed to log on.

    Subject:
    Security ID: SYSTEM
    Account Name: EXC01$( changed to protect client name)
    Account Domain: abcd( changed to protect client name)
    Logon ID: 0x3e7

    Logon Type: 3

    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name:
    Account Domain:

    Failure Information:
    Failure Reason: Account currently disabled.
    Status: 0xc000006e
    Sub Status: 0xc0000072

    Process Information:
    Caller Process ID: 0x1334
    Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe

    Network Information:
    Workstation Name: Exchangeserver
    Source Network Address: -
    Source Port: -

    Detailed Authentication Information:
    Logon Process: Authz   
    Authentication Package: Kerberos
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0

    T
    Monday, October 5, 2020 2:24 PM