I am getting a lot (thousands per day) of logon failures due to unknown username or bad password on my Exchange Server.
The failures in question will be due to invalid account names as the accounts reporting the failures do not exist on my network (though they may have at some point in the past). The caller process is SExchangeFrontEndTransport and the source IP Address is 127.0.0.1. I had previously written this off as someone trying to hack into a previously valid mailbox, or an ex employee who still has a device attempting to retrieve e-mail. However, I decided to dig into this a little more and found that the source IP address is 127.0.0.1 and now I am concerned.
My Environment is a single Exchange Server running in Hybrid mode.
The Exchange Server has been rebuilt from scratch and this was occurring before and after the server was rebuilt.
Any ideas what may be causing this or how I can track it down? Is it likely that there is something stuck in my AD environment that will need to be cleaned up through ADSI edit?
