Forum Discussion
techdummy
Dec 21, 2020Copper Contributor
Exchange server showing thousands of failed logons
I have a exchange server 2013 which keeps on showing thousands of failed logons to itself every hour. Does any one have any idea why this would be happening. Event 4625 just keeps on happening on the server
I had a look at the iis logs but cannot find the source ip.
- Pierfish
Microsoft
techdummy Event ID 4625 but, the substatus ? just to understand the cause of the event
Status and Sub Status Codes Description (not checked against "Failure Reason:") 0xC0000064 user name does not exist 0xC000006A user name is correct but the password is wrong 0xC0000234 user is currently locked out 0xC0000072 account is currently disabled 0xC000006F user tried to logon outside his day of week or time of day restrictions 0xC0000070 workstation restriction, or Authentication Policy Silo violation (look for event ID 4820 on domain controller) 0xC0000193 account expiration 0xC0000071 expired password 0xC0000133 clocks between DC and other computer too far out of sync 0xC0000224 user is required to change password at next logon 0xC0000225 evidently a bug in Windows and not a risk 0xc000015b The user has not been granted the requested logon type (aka logon right) at this machine