• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 214
  • Last Modified:

Getting loads of Event ID 4000 late at night

I'm getting around 30-100 of the event ID: 4000 each night. They can't connect to domains such as zmailz.com or publicrecordsnow.com or dxsspc1.com etc etc. Just curious if this means I've got a machine on our network trying to spam outside email? How do i track this down?
0
adminknight
Asked:
adminknight
1 Solution
 
Stacy SpearPresident/Principal ConsultantCommented:
This possibly means that spammers are sending you junk mail to bad addresses and Exchange is trying to send them NDRs. You don't have any messages in your queues?

Why possibly? You need to provide the Event Source as well. It could also be this for example http://support.microsoft.com/kb/899392
0
 
SembeeCommented:
Do you have messages in the queues? If not then it could be simply relay attempts that are failing. Nothing to worry about.

Simon.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now