asked on
Failure Audit - Event ID 680 on Exchange 2003 server
I have multiple software applications (i.e. Log management Software) and devices (Copiers that Scan to email) that have email addresses configured to send alerts, information and scanned documents. I have created the accounts in Active directory and assigned exchange email accounts for the devices/software and configured the devices/software to use the accounts from Active Directory. The email configurations seem to be working because I am getting alerts and scanned documents. However, we continue to get the following error on our Exchange server
Source: Security
Category: Account Logon
Event ID: 680
Logon attempt by: MICROSOFT_AUTHENTICATION_P
Logon account: copier1
Source Workstation: EXCHANGESRVR
Error Code: 0xC0000064
The failure audit event is generated every time, but we manage the get the email notifications without any issues. I am assuming that this is an authentication issue with Kerberos or NTLM, but i am not sure if we can do anything to clear up the events. It does not seem to be causing any issues on our Email server, it just generates 100s of log a day.
Source: Security
Category: Account Logon
Event ID: 680
Logon attempt by: MICROSOFT_AUTHENTICATION_P
Logon account: copier1
Source Workstation: EXCHANGESRVR
Error Code: 0xC0000064
The failure audit event is generated every time, but we manage the get the email notifications without any issues. I am assuming that this is an authentication issue with Kerberos or NTLM, but i am not sure if we can do anything to clear up the events. It does not seem to be causing any issues on our Email server, it just generates 100s of log a day.
Email SoftwareExchangeMicrosoft Server Apps
Last Comment
oritronen
Do you have HP Insight Manager Application ??
ASKER
No. How would I use the Insight Manager Application to solve this issue?
check all user rights and permissions. http://support.microsoft.com/kb/812614
Remove "NETWORK" account from "Deny access this computer from network" -
Refresh policy using "gpupdate" command from command prompt.
-x
ASKER
I am not sure what you mean by "Remove "Network" account from "Deny access to this computer". Where do I check for these permission settings? This seems to be an issue when a system (non-outlook) is used to send email notifications.
check the article.. http://support.microsoft.com/kb/812614
ASKER
I looked at the article, but this is not an IIS issue, so I am not sure where we need to modify the permissions.
ASKER
Any additional ideas on how to solve this issue.
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
Unable to locate Wlmssp registry subkey. Any suggestions?