Advertisement

07.16.2008 at 06:59AM PDT, ID: 23569661 | Points: 125
[x]
Attachment Details

Event ID:      539

Asked by Muhammad_Amjad in Windows 2003 Server

Tags: , ,

I receive following logs on my Exchange 2003 server very frequently. Even user' s mailbox is on another server.
Event Type:      Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      539
Date:            7/16/2008
Time:            7:32:12 PM
User:            NT AUTHORITY\SYSTEM
Computer:      Exchange-Server1
Description:
Logon Failure:
       Reason:            Account locked out
       User Name:      X@xxxxx.x
       Domain:      
       Logon Type:      3
       Logon Process:      Advapi  
       Authentication Package:      Negotiate
       Workstation Name:      Exchange-Server1
       Caller User Name:      Exchange-Server1$
       Caller Domain:      xxxxx
       Caller Logon ID:      (0x0,0x3E7)
       Caller Process ID: 4068
       Transited Services: -
       Source Network Address:      -
       Source Port:      -


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

AND ALSO following error for same user

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Account Logon
Event ID:      680
Date:            7/16/2008
Time:            7:32:12 PM
User:            NT AUTHORITY\SYSTEM
Computer:      ISB-MSC-NFEXS
Description:
Logon attempt by:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:      X@xxxxx.x
 Source Workstation:      Exchange-Server1
 Error Code:      0xC0000064


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Start Free Trial
[+][-]07.18.2008 at 07:09PM PDT, ID: 22041105

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628