• RSS
  • Twitter
  • FaceBook

Exchange Server Forums

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Account failed to logon

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [Microsoft Exchange 2010] >> General >> Account failed to logon Page: [1]
Login
Message << Older Topic   Newer Topic >>
Account failed to logon - 2.May2017 4:17:30 PM   
rrizzojr

 

Posts: 57
Joined: 30.Sep.2008
Status: offline
I am trying to resolve an account lockout issue. Typically this wouldn't be something I'd be asking here however the issue may be relevant. A domain user account is being locked out randomly and usually occurring early A.M. hours. When the user boots up computer and logs on for the start of their day, it immediately notifies them their account has been locked out. I ran ALTools.exe which displayed time of lockout. I checked security event logs on both domain controllers. The DC's showed that the logon workstation was their Exchange MAIL Server. I did not see any user profile folder under C:\Users so I had to look further. I have event information to share and the information being entered has been changed to protect the identity of the business.

\\ABC-DC02 (Domain Controller 2 PDC)

The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: User1
Source Workstation: ABC-MAIL
Error Code: 0xC000006A

Error code 0xC0000064 The username you typed does not exist. Bad username.

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

\\ABC-DC1 (Domain Controller)

A user account was locked out.

Subject:
Security ID: SYSTEM
Account Name: ABC$
Account Domain: ABC
Logon ID: 0x3e7

Account That Was Locked Out:
Security ID: ABC\User1
Account Name: User1

Additional Information:
Caller Computer Name: ABC-MAIL

---------------------------------------------------------------------------------------------------------------------------------------------

\\ABC-MAIL (Exchange 2010 Server)

An account failed to log on.

Subject:
Security ID: NETWORK SERVICE
Account Name: ABC-MAIL$
Account Domain: ABC
Logon ID: 0x3e4

Logon Type: 8

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: User1
Account Domain:

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc000006a

Process Information:
Caller Process ID: 0xea8
Caller Process Name: C:\Program Files\Microsoft\Exchange Server\V14\ClientAccess\PopImap\Microsoft.Exchange.Imap4.exe

Network Information:
Workstation Name: ABC-MAIL
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Transited Services: -
Package Name (NTLM only): -
Key Length: 0


Please note above that the Domain controllers and domain name is ABC. One event was identified from each domain controller and one from Exchange mail server. Can someone identify what is locking the user account?

< Message edited by rrizzojr -- 2.May2017 4:21:36 PM >
Post #: 1

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [Microsoft Exchange 2010] >> General >> Account failed to logon Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts


Follow TechGenix on Twitter