Jun 03 2020
Can anyone help me with some ideas on how to track this down?
I am getting several Audit Failures every minute on my Exchange Server. This is the event log entry:
An account failed to log on.
Subject:Security ID: NULL SIDAccount Name: -Account Domain: -Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:Security ID: NULL SIDAccount Name: <Name of Exchange Server>$Account Domain: <Correct Domain>
Failure Information:Failure Reason: An Error occured during Logon.Status: 0xC000006DSub Status: 0x0
Process Information:Caller Process ID: 0x0Caller Process Name: -
Network Information:Workstation Name: <Name of Exchange Server>Source Network Address: <Correct IP Address of Exchange Server>Source Port: 6476 <Seems to be random>
Detailed Authentication Information:Logon Process:Authentication Package: NTLMTransited Services: -Package Name (NTLM only): -Key Length: 0
The exchange server seems to be working okay, but I want to eliminate these failures but cannot track them down.