I receive following logs on my Exchange 2003 server very frequently. Even user' s mailbox is on another server.
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 539
Date: 7/16/2008
Time: 7:32:12 PM
User: NT AUTHORITY\SYSTEM
Computer: Exchange-Server1
Description:
Logon Failure:
Reason: Account locked out
User Name: X@xxxxx.x
Domain:
Logon Type: 3
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: Exchange-Server1
Caller User Name: Exchange-Server1$
Caller Domain: xxxxx
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 4068
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
AND ALSO following error for same user
Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 7/16/2008
Time: 7:32:12 PM
User: NT AUTHORITY\SYSTEM
Computer: ISB-MSC-NFEXS
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_P
ACKAGE_V1_
0
Logon account: X@xxxxx.x
Source Workstation: Exchange-Server1
Error Code: 0xC0000064
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Start Free Trial