FW: 535 errors in security log
No, he does NOT have an exchange mailbox. He has Outlook installed with the profile being built using his NT LAN ID which normally is the Exchange mailbox alias for the end users here. However, since he does not have an exchange mailbox, he cannot open Outlook. He just gets the generic error, "Unable to open you folders". Also, the NT ID was not locked, the w/s was locked and the password had expired. As far as the last statement, we do have rightfax and winfax in use here. Maybe on of those apps was trying to use the mapi profile on the w/s. Think I need to do a network trace and see exactly what is being sent over the wire. Michael Semiglia -Original Message- From: Drewski [mailto:[EMAIL PROTECTED]] Sent: Friday, August 24, 2001 9:58 AM To: Exchange Discussions Subject: RE: 535 errors in security log wait... so he DID have a mailbox, right? He just doesn't use it? I'd say that the problems occured because the NT ID was locked, and some other process was trying to access the mailbox, and because the ID was locked, that interfered. As far as I know, when Outlook is shut down, it's shut down, and not attempting to talk to the Exchange server in any way. Drew (MOS) KWAR2001 website: www.schoolofdefence.org/kwar.html Read my Column on OUTLOOKEXCHANGE.COM: http://www.outlookexchange.com/articles/drewnicholson/default.asp Pics of Max are BACK! http://www.drewncapris.net "One kind word can warm three winter months." Chinese proverb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Semiglia, Michael Sent: Friday, August 24, 2001 6:28 AM To: Exchange Discussions Subject: FW: 535 errors in security log We did a little more t/s last night. Had a user who left their NT w/s locked for a week while out of town on a conference. During that week we think the password expired. No stuck keyboard of process or any kind of coding running. The user does NOT have an exchange mailbox. We have two email systems here, Notes being the other. However, he did have Outlook installed. We automatically build an outlook profile for users based on the NT login ID which matches the mailbox alias. While we were getting the errors, I was unable to check the outlook profile properties. The panel just kept hanging. We then set the password in the account domain to never expire. The 535 errors immediately went away. At that point I was able to get into the outlook profile properties and view all the configuration setups. The conclusion thus far is that Outlook was trying to match up the alias to the address box and kept failing because of the expired password and the fact that there is no mailbox for that user. Did not realize that even though Outlook is not running, it still has a portion of itself that is actively talking to the exchange servers. I am not sure if this falls under the category of bug or feature. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 23, 2001 10:10 AM To: Exchange Discussions Subject: RE: 535 errors in security log Perzactly - a process rather than a person is doing it. -Original Message- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 23, 2001 8:54 AM To: Exchange Discussions Subject: RE: 535 errors in security log Also, make sure that nobody is writing code that connects to your Exchange Server for sending emails. Their process may be trying to login with wrong credentials. S. -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 5:05 PM To: Exchange Discussions Subject: RE: 535 errors in security log Could NAV be trying to open mailboxes with invalid credentials? I don't use it, not sure how it works. Lori Hunter LAN Administrator Citi Commerce Solutions (847) 597-3118 Sic gorgiamus allos subjectatos nuc -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:00 PM To: Exchange Discussions Subject: FW: 535 errors in security log Nope, vanilla exch 5.5 server. Not even any connectors. We do have NAVMSE running. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:50 PM To: Exchange Discussions Subject: RE: 535 errors in security log Anything else running on that exchange server? Fax? Virus scanner? -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 3:39 PM To: Exchange Discussions Subject: FW: 535 errors in security log Have not spoken to Joes. We get this error for multiple people. Some on laptops, some working home, some at the office. There is no common thread that I have been able to discover. We use NT 4 w/s and use the built in screensaver. Michael Semiglia -
FW: 535 errors in security log
We did a little more t/s last night. Had a user who left their NT w/s locked for a week while out of town on a conference. During that week we think the password expired. No stuck keyboard of process or any kind of coding running. The user does NOT have an exchange mailbox. We have two email systems here, Notes being the other. However, he did have Outlook installed. We automatically build an outlook profile for users based on the NT login ID which matches the mailbox alias. While we were getting the errors, I was unable to check the outlook profile properties. The panel just kept hanging. We then set the password in the account domain to never expire. The 535 errors immediately went away. At that point I was able to get into the outlook profile properties and view all the configuration setups. The conclusion thus far is that Outlook was trying to match up the alias to the address box and kept failing because of the expired password and the fact that there is no mailbox for that user. Did not realize that even though Outlook is not running, it still has a portion of itself that is actively talking to the exchange servers. I am not sure if this falls under the category of bug or feature. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 23, 2001 10:10 AM To: Exchange Discussions Subject: RE: 535 errors in security log Perzactly - a process rather than a person is doing it. -Original Message- From: Soysal, Serdar [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 23, 2001 8:54 AM To: Exchange Discussions Subject: RE: 535 errors in security log Also, make sure that nobody is writing code that connects to your Exchange Server for sending emails. Their process may be trying to login with wrong credentials. S. -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 5:05 PM To: Exchange Discussions Subject: RE: 535 errors in security log Could NAV be trying to open mailboxes with invalid credentials? I don't use it, not sure how it works. Lori Hunter LAN Administrator Citi Commerce Solutions (847) 597-3118 Sic gorgiamus allos subjectatos nuc -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:00 PM To: Exchange Discussions Subject: FW: 535 errors in security log Nope, vanilla exch 5.5 server. Not even any connectors. We do have NAVMSE running. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:50 PM To: Exchange Discussions Subject: RE: 535 errors in security log Anything else running on that exchange server? Fax? Virus scanner? -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 3:39 PM To: Exchange Discussions Subject: FW: 535 errors in security log Have not spoken to Joes. We get this error for multiple people. Some on laptops, some working home, some at the office. There is no common thread that I have been able to discover. We use NT 4 w/s and use the built in screensaver. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:23 PM To: Exchange Discussions Subject: RE: 535 errors in security log Sounds like a process rather than a user is causing that. For example, I run a screensaver package that requires you to enter your LAN password rather than some silly one-character windows password, and if the spacebar (or any repeating key) on the keyboard is stuck down or depressed (like by a chair arm) we will get thousands of these logon failures until the service Dr. Watsons. Have you spoken to JoeS? Lori Hunter LAN Administrator Citi Commerce Solutions (847) 597-3118 "Out think, Out smart, Out medicate" - Steinvivor -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 2:52 PM To: Exchange Discussions Subject: 535 errors in security log NT SP6a ExchSP4 - audit turned on for log on failures and successes - mandated by security guidelines. Exchange is in a resource domain and user accounts are in the Account domain. Resource domain trusts account domain with a one way trust. Over the last couple of weeks I am getting hundreds of 535 errors every MINUTE in the NT Security event logs on the resource domain controllers that house the exchange system. This has the effect of eating up space on the server due to the fact that we have to keep all of out logs around for a while. The server guys swear that it is an Outlook/Exchange issue since they are not seeing the errors on the account domain controllers log files. Poked around MS KB and also Google, however was not able to find anything. Does anyone have any ideas? Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID:
FW: 535 errors in security log
Nope, vanilla exch 5.5 server. Not even any connectors. We do have NAVMSE running. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:50 PM To: Exchange Discussions Subject: RE: 535 errors in security log Anything else running on that exchange server? Fax? Virus scanner? -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 3:39 PM To: Exchange Discussions Subject: FW: 535 errors in security log Have not spoken to Joes. We get this error for multiple people. Some on laptops, some working home, some at the office. There is no common thread that I have been able to discover. We use NT 4 w/s and use the built in screensaver. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:23 PM To: Exchange Discussions Subject: RE: 535 errors in security log Sounds like a process rather than a user is causing that. For example, I run a screensaver package that requires you to enter your LAN password rather than some silly one-character windows password, and if the spacebar (or any repeating key) on the keyboard is stuck down or depressed (like by a chair arm) we will get thousands of these logon failures until the service Dr. Watsons. Have you spoken to JoeS? Lori Hunter LAN Administrator Citi Commerce Solutions (847) 597-3118 "Out think, Out smart, Out medicate" - Steinvivor -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 2:52 PM To: Exchange Discussions Subject: 535 errors in security log NT SP6a ExchSP4 - audit turned on for log on failures and successes - mandated by security guidelines. Exchange is in a resource domain and user accounts are in the Account domain. Resource domain trusts account domain with a one way trust. Over the last couple of weeks I am getting hundreds of 535 errors every MINUTE in the NT Security event logs on the resource domain controllers that house the exchange system. This has the effect of eating up space on the server due to the fact that we have to keep all of out logs around for a while. The server guys swear that it is an Outlook/Exchange issue since they are not seeing the errors on the account domain controllers log files. Poked around MS KB and also Google, however was not able to find anything. Does anyone have any ideas? Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 535 Date: 8/22/2001 Time: 12:00:02 PM User: NT AUTHORITY\SYSTEM Computer: server1<---This is an exchange server in resource domain Description: Logon Failure: Reason: The specified account's password has expired User Name: joes <---User in account domain Domain: fire <--- Resource domain Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: PTLL78HB074 Thank You! Michael Semiglia Exchange E-mail Engineering *207 575-1094 *[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
FW: 535 errors in security log
Have not spoken to Joes. We get this error for multiple people. Some on laptops, some working home, some at the office. There is no common thread that I have been able to discover. We use NT 4 w/s and use the built in screensaver. Michael Semiglia -Original Message- From: Hunter, Lori [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 4:23 PM To: Exchange Discussions Subject: RE: 535 errors in security log Sounds like a process rather than a user is causing that. For example, I run a screensaver package that requires you to enter your LAN password rather than some silly one-character windows password, and if the spacebar (or any repeating key) on the keyboard is stuck down or depressed (like by a chair arm) we will get thousands of these logon failures until the service Dr. Watsons. Have you spoken to JoeS? Lori Hunter LAN Administrator Citi Commerce Solutions (847) 597-3118 "Out think, Out smart, Out medicate" - Steinvivor -Original Message- From: Semiglia, Michael [mailto:[EMAIL PROTECTED]] Sent: Wednesday, August 22, 2001 2:52 PM To: Exchange Discussions Subject: 535 errors in security log NT SP6a ExchSP4 - audit turned on for log on failures and successes - mandated by security guidelines. Exchange is in a resource domain and user accounts are in the Account domain. Resource domain trusts account domain with a one way trust. Over the last couple of weeks I am getting hundreds of 535 errors every MINUTE in the NT Security event logs on the resource domain controllers that house the exchange system. This has the effect of eating up space on the server due to the fact that we have to keep all of out logs around for a while. The server guys swear that it is an Outlook/Exchange issue since they are not seeing the errors on the account domain controllers log files. Poked around MS KB and also Google, however was not able to find anything. Does anyone have any ideas? Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 535 Date: 8/22/2001 Time: 12:00:02 PM User: NT AUTHORITY\SYSTEM Computer: server1<---This is an exchange server in resource domain Description: Logon Failure: Reason: The specified account's password has expired User Name: joes <---User in account domain Domain: fire <--- Resource domain Logon Type: 3 Logon Process: NtLmSsp Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: PTLL78HB074 Thank You! Michael Semiglia Exchange E-mail Engineering *207 575-1094 *[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED] _ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin:[EMAIL PROTECTED]
