Outlook Frequently Disconnected from Exchange Server in LAN....!

dxbdxb2009
dxbdxb2009 used Ask the Experts™
on
We have exchange server 2003 hosted inhouse in our company. all users are working under LAN.
all was going well, but one day 2-3 users stared asking the password in there outlook. which was not even asked before. so i have given there outlook passwords & it was connected & password was expected by server.
but after few days users are frequently asked outlook pwd & when they put the pwd it is not acceptable it say wrong pwd. so when I put exchange domain admin username & pwd it took, and when user try there own pwd it took.
So i mean to say outlook frequently ask the pwd & when we put the correct pwd it doesnt take.
we can even see right side of the bottom in outlook frequently "trying to connect"
what I found in event viewer of exchange server is attached (pls have a look on attached file)
I have installed kaspersky AV in client side but i tried disabling & uninstalling it but the outlook problem remained same.
Kindly let me know what is the problem into my exchange server.
many thanks .
best regards,
DXB
21.7.09.JPG
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Are you using drive mappings on the affected users computers?
If you are, delete the mappings and then set them back up again in a DOS prompt by using the following details:
net use x: \\computername\share /user:domain\userid password /persistent:yes
(Change the relevant parts to match your environment)
This will force the mapping to remember the users credentials, which is often a cause of account lockouts.
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Also - have a read through this article which suggests yo may have a viru son the loose!
http://www.eventid.net/display.asp?eventid=12294&eventno=875&source=SAM&phase=1 
Awarded 2009
Top Expert 2010

Commented:
You could also try a detect and repair from the outlook help menu, I am assuming the other errors are for different accounts? As this one is fir the administrator?
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Awarded 2009
Top Expert 2010

Commented:
The lockout of accounts is also caused by Conficler gave you done a full system scan and completely patched up?

Author

Commented:
alanhardisty - No we are not using any drive mapping to our exchange server with any PC for Virus I can double check again.
Demazter - Detect & Repair did not worked for me. The all errors shown in the JP EG are for Administrator account and source is SAM & Event ID is 12294. Second thing i noted when i disable to user who is having problem longing into outlook & then enable it again with in 2 minutes use can log in with the same password.

I really fade up with this problem

suddenly users started asking me the passwords since they did not use to put any passwords.

awaiting for your earlier reply.
many thanks.
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Awarded 2009
Top Expert 2010

Commented:
It definately sounds viral!
Check for odd looking scheduled tasks on the client machines experiencing the problem.
Awarded 2009
Top Expert 2010

Commented:
There are a number that cause this issue, Randex, conficker

Author

Commented:
when a user was asked the password on his client machine in outlook, i did not do anything after 5 mints he was logged on with the same password which he was given, meaning users are automatically being asked passwords & when they try to put the passwords which they have been give, outlook is not excepting that passwords.
When I go to the users PC and put the admin users name & pwd in there outlook it was excepted 98 times out of 100 but 2 times is also reject the admin username pwd also.

what all found in the security tab under even viewer on "Failure Audit" on exchange server: -
Logon Failure:
       Reason:            Account locked out
       User Name:      dxb
       Domain:      mydomainname.com
       Logon Type:      3
       Logon Process:      NtLmSsp
       Authentication Package:      NTLM
       Workstation Name:      dxb
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID: -
       Transited Services: -
       Source Network Address:      192.168.1.60
       Source Port:      1932
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Exchange is installed with "Kaspersky 5.5 Security for Exchange server".

Pls let me know what can be the cause of problem
If possible pls reply me as quick as possible.
I really appreciate if you reply me soon.
Thanks a lot once again.
DXB

Author

Commented:
Even what all other I found on my Exchange Server is related to Event ID 9646 Source MSExchangeIS.
what all I can see on google is here: -
http://www.eventid.net/display.asp?eventid=9646&eventno=3449&source=MSExchangeIS&phase=1

I have two users on Outlook 2007, do i have to remove two registry settings: -
{HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\Mindjet.Mm7OutlookLinker.AddIn.3
HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\Mindjet.Mm7OutlookMapMinderLinker.AddIn.3. }
 as described in the above link?

Is this can be the reason my outlook users are not able to connect to exchange server or what else

Pls reply me since in two days all my outlook users are eating my brain.

An earlier reply will be appropriate.
Thanks & Best regards,
DXB

Awarded 2009
Top Expert 2010

Commented:
It's worth a try but have you done a full virus sweep?

Author

Commented:
alanhardisty -
demazter -

Sorry for replying you late,
I have installed Kaspersky Security for Exchange Server in my server & it is running & protecting the mailboxes & files.
But the error of connecting from users to exchange server is still same,
what all major error msgs i am able to see on exchange event log is as follow:-
***********************************************************************************************************
S.No         Log Type                        Type      Source                          Event ID
1.       Application Log                  Error      MSExchangeIS            9646
2.      System Log                        Error      SAM                                  12294      
3.      System Log                        Error      Netlogon                            5513
4.      System Log                        Error      MSExchangeIS Mailbox      1022
******************************************************************************************************
I really fade up with the problem. All most users are shouting at me since i did not find any solution.
I will greatly appreciate you people help if it can be as soon as possible.
Thanks!
DXB
Awarded 2009
Top Expert 2010

Commented:
Have you performed a full system manual virus scan?

Author

Commented:
Yes! but KS did not find any Virus on the system!

Author

Commented:
Sorry to add -
KS for Windows Server Enterprise edition found 25 virus(but I don't know how can I see which were these virus, since this version of AV can only be administreded by KS Admin Kit so I just found that is got 25 Virus , see the attached screen shot.)
We have purchased KS Total Space Security,thus I have been told to installed KS for Windows Server Enterprise Edition for my exchange server 2003.
Now i can scan, update & see virus count only through KS Admin Kit for this server.
Before 15 mints back i did the scan using it on my exchange server now i don't know which all virus found on it.
Pls see below Event Log on my exchange server even after scanning : -
***************************************************************************
Application Event Viewer :
Source = MSExchangeIS
Event ID = 9646
Category = General
"Mapi session "/o=POD/ou=first administrative group/cn=Recipients/cn=kv" exceeded the maximum of 500 objects of type "objtFolderView".
********************************************************
System Event Viewer :
Source = SAM
Event ID = 12294
Category = None
The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above.
******************************************************************************************
Pls let me know the little description why these error are being occurring & how can we get rid of these.
Pls be noted that we have two outlook users who are using Office 2007 Pro edition.

I have much expectation from you experts.
Pls reply me ASAP with the helpful answers.
Thanks once again.
DXB.

Author

Commented:
demazter -
Any suggestion please!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Please stay with me, so i can say that i am working on it to my users!
Thax
Awarded 2009
Top Expert 2010

Commented:
Sorry it is Sunday afternoon, I am still here don't worry.

You need to remove those 25 viruses and identify them if possible to give us an idea of what they are.

You could try downloading a trial of another virus software to see if that helps.  I like to use www.eset.com as it's lightweight and very efficient.
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Try Panda Online Scanner which will detect and eliminate viruses without having to install any software - http://www.pandasoftware.es/activescan/activescan-com.asp

Author

Commented:
demazter -  Sorry Demazter, I really don't want to install any other antivirus since we already install KS total Space securty & it is online server i don't don't want to do any RND on this line server.
alanhardisty - will Kaspersky let me do a online scan from Panda Online Scanner?
I don't know how to see where these objects which are infected in KS AV for Enterprise edition on my exchange server?
What all I noted is that the users account is "Locked Out" automatically. This is i have seen in AD users & computers---> users Property----> Account.
The box "Account is Locked Out" is checked Marked.
Please help me, I still feel some one from you experts can only give me best suggestion....!
Awaiting for your earlier reply.
Thanks a lot.
DXB
Awarded 2009
Top Expert 2010

Commented:
Over to you alan I have never used KS but your first port of call needs to be to find and remove these viruses, the software must have a manual scan and disinfect option?

The online scanner is also a good option.
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Kaspersky should let you scan - I have scanned many different servers / workstations with other Anti-Virus installed on them.
It is just running a web-based scan - not installing anything, so it should not object.
I don't know Kaspersky personally either - but all the others are happy.
Your account lockouts are almost certainly as a result of a virus trying to break the password, so clean up the viruses and the lockouts should go away.

Author

Commented:
alanhardisty - tomorrow i will try but frankly speaking i dont want to put my server online for any venrability .
are you sure http://www.pandasoftware.es/activescan/activescan-com.asp will rectify the error?

Pls give me some best online scanner where i can scan my exchange server with full confident & which my KS also let them scan?
Pls reply soon.
Thanks
DXB
Alan HardistyCo-Owner
Top Expert 2011

Commented:
The Panda Scan claims to be able to detect and repair the errors for free.  It will need to be connected to the internet to start off the scan and no doubt at the end of the scan.  You can probably disconnect it from the internet during the scan to be safe.

Author

Commented:
alanhardisty - i will do the online scanning with Panda tomorrow since i am not in the office for today,
but pls advise if i wish to uninstall it after my server is virus free & in that condition will my KS work properly?
And how can i be assure that KS will be disinfecting all threats & attacks.  
Pls suggest me the best thing.
thanks.
Alan HardistyCo-Owner
Top Expert 2011

Commented:
There is nothing to uninstall - it is an online scanner and thus will not install anything that will upset KS when you try to install it.
Any Anti-Virus program will only be able to deal with threats that it knows about and some that it does not know about, but, no matter what software you use, careless use of the Internet or poor user education can render the software useless.
Installing some software is better than installing nothing, but it is only part of the process to stop viruses.  The rest is down to education.

Author

Commented:
alanhardisty -
Thanks for the reply!
I install KS 6.0 with full updates & scan in safe mode it deleted all viruses.
Now there is no virus in my exchange, Even some of my user accounts are disconnected from server then i see that user property that user is locked out automatically.
Can you pls see in this matter urgently, if you want i can send you event log(app, security, system etc.)
I really need your help for getting this issue solved soon.
Awaiting for your earlier reply.
Thanks
DXB
Alan HardistyCo-Owner
Top Expert 2011

Commented:
Please download the Sophos Conficker Removal Tool and scan your network to see if you have a conficker worm on any of your PC's.
http://www.sophos.com/products/free-tools/conficker-removal-tool.html 

Author

Commented:
alanhardisty - thanks for being with me.......
tomorrow I am going to run the tool in my network.
Any suggestion / advice / steps for the tools.........?
Thanks!
DXB
Co-Owner
Top Expert 2011
Commented:
The instructions to follow are documented here:
http://www.sophos.com/support/knowledgebase/article/51416.html
Having never had to run the tool - I cannot add any personal recommendations.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial