Forum Discussion

techdummy's avatar
techdummy
Copper Contributor
Dec 21, 2020

Exchange server showing thousands of failed logons

I have a exchange server 2013 which keeps on showing thousands of failed logons to itself every hour. Does any one have any idea why this would be happening. Event 4625 just keeps on happening on the server

 

I had a look at the iis logs but cannot find the source ip.

 

  • techdummy Event ID 4625 but, the substatus ? just to understand the cause of the event

     

     

    Status and Sub Status Codes Description (not checked against "Failure Reason:") 
    0xC0000064 user name does not exist
    0xC000006A user name is correct but the password is wrong
    0xC0000234 user is currently locked out
    0xC0000072 account is currently disabled
    0xC000006F user tried to logon outside his day of week or time of day restrictions
    0xC0000070 workstation restriction, or Authentication Policy Silo violation (look for event ID 4820 on domain controller)
    0xC0000193 account expiration
    0xC0000071 expired password
    0xC0000133 clocks between DC and other computer too far out of sync
    0xC0000224 user is required to change password at next logon
    0xC0000225 evidently a bug in Windows and not a risk
    0xc000015b The user has not been granted the requested logon type (aka logon right) at this machine

Resources