NT SP6a ExchSP4 - audit turned on for log on failures and successes -
mandated by security guidelines. Exchange is in a resource domain and user
accounts are in the Account domain. Resource domain trusts account domain
with a one way trust.
Over the last couple of weeks I am getting hundreds of 535 errors every
MINUTE in the NT Security event logs on the resource domain controllers that
house the exchange system. This has the effect of eating up space on the
server due to the fact that we have to keep all of out logs around for a
while. The server guys swear that it is an Outlook/Exchange issue since they
are not seeing the errors on the account domain controllers log files. Poked
around MS KB and also Google, however was not able to find anything. Does
anyone have any ideas?
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 535
Date: 8/22/2001
Time: 12:00:02 PM
User: NT AUTHORITY\SYSTEM
Computer: server1 <---This is an exchange server in resource domain
Description:
Logon Failure:
Reason: The specified account's password has expired
User Name: joes <---User in account domain
Domain: fire <--- Resource domain
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: PTLL78HB074
Thank You!
Michael Semiglia
Exchange E-mail Engineering
*207 575-1094
*[EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
