Hello!
During monitoring of Exchange Server logs I found that multiple login failure attempts were made by existing users on exchange server having event ID 4625 with two different sub-status codes:
1. 0xC0000064 ( Username does not exist )
2. 0xC000006A ( user name is correct but the password is wrong )
I know the user does exist, there's no typing mistake in the username but it still shows sub-status code 0xC0000064 and in some events it shows 0xC000006A ( which could be normal because of user typing wrong password ).
Did anyone face any similar situation? Does anybody know what could be the possible reason?
TIA
