Forum Discussion

Copper Contributor

Mar 11, 2023

Exchange 2016 Event 2159 ADAccess Validation Failed

We intermittently see event id 2159 generated on our Exchange 2016 Server (CU23 Jan23SU). They seem to have appeared sometime in the past month. We tend to see about 50-150 events per day. We've e...

Exchange Server

SaschaSeipp

Brass Contributor

Dec 11, 2023

In case anyone stumbles upon this thread and misses the ending.. ;-):

Apparently Crowdstrike somehow has fixed the issue by "automatically identifying the Exchange servers" and not doing for them what they do for/with the other servers. This has already happened some months ago, I just forgot to get back to this thread here. Since then, we had no more issues.

h1ckman

Copper Contributor

Dec 11, 2023

SaschaSeipp So they closed your ticket with CrowdStrike? Is there an CS article about this or the resolution documented on their site?

h1ckman
Copper Contributor
Dec 11, 2023
Thank you so much.
swguy89
Copper Contributor
Dec 11, 2023
h1ckmanYes, they published a KB article and sent a Tech Alert out back in July about the issue.
I don't remember which version of the sensor they fixed it in but it has since been fixed and we too have not had the issue again.

https://supportportal.crowdstrike.com/s/article/Identity-Protection-Falcon-Sensor-Authentication-Traffic-Inspection-May-Interfere-with-Microsoft-Exchange-On-Premise