Re: Login Auditing

On Mon, 16 Feb 2009 20:21:09 -0500, Andy David {MVP}
<adavid@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

On Mon, 16 Feb 2009 16:38:12 -0800, "ED" <nospam@xxxxxxxxxxxx> wrote:

It was working perfectly until it started last week.
Users don't enter their username/password. It is stored in outlook express
with the POP3 account settings.
(This is strictly an email server with no users logging into the
server/domain for resources/etc.)

I will check if any Windows and/or Exchange updates were been installed.

I am leaning more towards someone trying to hack the server, which is why I
was looking into auditing unsuccessful logins.

There is diagnostic logging in ESM for pop3. You could also increase
logging in OE ( I think its under Advanced Tab). I would test within
the LAN as well.


For some reason I assumed ESM, sory. For Exchange 2007:
Microsoft.Exchange.Pop3.exe.config
http://technet.microsoft.com/en-us/library/aa997690.aspx

FWIW, I had an issue similar to yours with IMAP some time ago after
applying a roll-up. Having the user logon with their UPN (
user@xxxxxxxxxx) instead of domain\user solved it.


ED.

"Andy David {MVP}" <adavid@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6ltjp49b8pli2ejksocqnju304qtgg2k1m@xxxxxxxxxx
On Mon, 16 Feb 2009 13:05:03 -0800, "ED" <nospam@xxxxxxxxxxxx> wrote:

Hi,

Exchange 2007 SP1 up to date.

Users are being locked out of their mailbox and I'm trying to find out why.
(I know it's the security policy, but what's causing the unsuccessful
logins?) Is it possible through exchange to log the unsuccessful mailbox
access attempts? I would need to get at least the username and source IP
address.

I have enabled auditing through windows 2003, but the IP address is always
blank.

I don't know if this is relevant, but users are using Outlook Express -
POP3.

Thanks in advance,

ED



When did this start? Did it work before? What format are users
entering their username?

.

Relevant Pages

  • RE: Cant send or receive e-mail to POP3 users on same domain--HELP!
    ... Run the CEICW and go through the Internet and firewall option. ... If you choose to forward emails to the ISP's email server (smart ... Connector for POP3 Mailboxes' option, ... The Mailbox type is User Mailbox, and select the appropriate Exchange ...
    (microsoft.public.windows.server.sbs)
  • Re: Cant send or receive e-mail to POP3 users on same domain--HELP!
    ... they are users who are all using the same Exchange ... "It can't seem to send messages to ANY POP3 ... thus do not use the Exchange server at all. ... you add the all individual user POP3 mailboxes into the POP3 Connector ...
    (microsoft.public.windows.server.sbs)
  • Sending email to mydomain.com
    ... They do not offer an smtp server, ... different from the user account names for the exchange ... I added one user account in the POP3 Mailbox Accounts ...
    (microsoft.public.windows.server.sbs)
  • RE: Exchange "Light" setup opinions wanted...
    ... If you use POP3 connector, it may download e-mails from ISP every 15 mins. ... Microsoft CSS Online Newsgroup Support ... Monitoring the Exchange server. ...
    (microsoft.public.windows.server.sbs)
  • RE: is there a windows or exchange equivalent of fetchmail?
    ... SBC email account and put it on a local exchange mailbox. ... In SBS Server, we can use the POP3 Connector to ... retrieve incoming email from ISP POP3 mailboxes. ...
    (microsoft.public.windows.server.sbs)
Loading