Getting two different sub-status codes on same username

Copper Contributor

During monitoring of Exchange Server logs I found that multiple login failure attempts were made by existing users on exchange server having event ID 4625 with two different sub-status codes:


1. 0xC0000064 ( Username does not exist )

2. 0xC000006A ( user name is correct but the password is wrong )


I know the user does exist, there's no typing mistake in the username but it still shows sub-status code 0xC0000064 and in some events it shows 0xC000006A ( which could be normal because of user typing  wrong password ).

Did anyone face any similar situation? Does anybody know what could be the possible reason?


0 Replies