Security Logo Failed Exchange 2007 / IIS

Hi,

I am getting hundreds of security failed logs from windows event viewer.


An account failed to log on.

Subject:
      Security ID:            SYSTEM
      Account Name:            SRV03$
      Account Domain:            IFW
      Logon ID:            0x3e7

Logon Type:                  3

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            
      Account Domain:            

Failure Information:
      Failure Reason:            Account currently disabled.
      Status:                  0xc000006e
      Sub Status:            0xc0000072

Process Information:
      Caller Process ID:      0xba8
      Caller Process Name:      C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
      Workstation Name:      SRV03
      Source Network Address:      -
      Source Port:            -

Detailed Authentication Information:
      Logon Process:            Authz  
      Authentication Package:      Kerberos
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0


After I did some research about this event log, I found that it is related to IIS. And I had a look at the log files of IIS and found this error.

2015-04-07 02:03:03 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC2_LdapL0_RpcC28_RpcL34_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 254
2015-04-07 02:03:03 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC2_LdapL0_RpcC34_RpcL40_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 332
2015-04-07 02:03:04 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC1_LdapL15_RpcC17_RpcL16_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 162
2015-04-07 02:03:04 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC1_LdapL0_RpcC13_RpcL18_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 102
2015-04-07 02:03:04 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC1_LdapL0_RpcC13_RpcL14_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 92
2015-04-07 02:03:04 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC2_LdapL0_RpcC28_RpcL31_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 318
2015-04-07 02:03:05 192.168.0.3 POST /Microsoft-Server-ActiveSync/default.eas User=user1&DeviceId=ApplDYTHQSUZDVGK&DeviceType=iPad&Cmd=ItemOperations&Log=V121_LdapC2_LdapL15_RpcC28_RpcL24_Pk2503518541_ 443 user1192.168.10.x Apple-iPad3C3/1202.466 200 0 0 248


What would be the cause of this issue here?
EducadAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Zacharia KurianAdministrator- Data Center & NetworkCommented:
Have you enabled Active Sync for user1?

Please log in to your ECP, search for this User1 and check if you added his Ipad for Active Sync. If this user1 doesn't require Active Sync, delete the Device and make sure to delete his account from his Ipad.


Zac.
0
EducadAuthor Commented:
He is using his iPad at the moment and he still has all email access from his iPad. I have also confirmed that his device is showing under active sync device partnership using this cmd Get-ActivesyncDeviceStatistics -Mailbox abc@domain.com
0
Zacharia KurianAdministrator- Data Center & NetworkCommented:
Please diagnostic or health check of your ActiveSync service using https://testconnectivity.microsoft.com/
and post the details. Also check the IOS version on the ipad and post it.



Zac.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Guy LidbetterCommented:
Hi Educad...

These are Activesync device sync issues. Very common with Apple devices.

Take note of the iPad iOS Version, and immediately remove his Ipad from his activesync devices... This will put a lot of load on the CAS servers otherwise.

Post the iOS version here, and the exchange version you are running

Don't allow the device to reconnect until you have confirmed the iOS version is fully supported on your version of exchange.

Often you have to add device exclusions for versions of iOS because of these issues.
0
EducadAuthor Commented:
FirstSyncTime         : 21/06/2012 5:35:18 AM
LastPolicyUpdateTime  : 29/09/2014 12:50:02 AM
LastSyncAttemptTime   : 8/04/2015 1:59:11 AM
LastSuccessSync       : 8/04/2015 1:59:11 AM
DeviceType            : iPad
DeviceID              : ApplDYTHQSUZDVGK
DeviceUserAgent       : Apple-iPad3C3/1202.466
DeviceWipeSentTime    :
DeviceWipeRequestTime :
DeviceWipeAckTime     :
LastPingHeartbeat     : 3540
RecoveryPassword      : ********
DeviceModel           : iPad3C3
DeviceIMEI            :
DeviceFriendlyName    : White iPad
DeviceOS              : iOS 8.1.3 12B466
DeviceOSLanguage      : en
DevicePhoneNumber     :
Identity              : user1@domain.com\AirSync-iPad-ApplDYTHQSUZDVGK
0
EducadAuthor Commented:
Exchange version is 2007 running on Windows Server 2008
0
Zacharia KurianAdministrator- Data Center & NetworkCommented:
Have read the below from Microsoft?

http://support.microsoft.com/en-us/kb/2563324

Zac
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.