Event ID 4625 is logged every 5 minutes when using the Exchange 2010 Management Pack in System Center Operations Manager

When using the Exchange 2010 Management Pack in System Center Operations Manager , you may receive a security audit failure event in the Security event log every 5 minutes. An example of the event is below:

Log Name: Security
Source:        Microsoft-Windows-Security-Auditing
Date:         
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      XXX

Description:
An account failed to log on.
 
Subject:
                Security ID:                         NULL SID
                Account Name:                 -
                Account Domain:                             -
                Logon ID:                             0x0
 
Logon Type:                                       3
 
Account For Which Logon Failed:
                Security ID:                         NULL SID
                Account Name:                 Aextest_39076b2bb6ec4
                Account Domain:                             XXXXXX
 
Failure Information:
                Failure Reason:                 Unknown user name or bad password.
                Status:                                  0xc000006d
                Sub Status:                         0xc0000064
 
Process Information:
                Caller Process ID:             0x0
                Caller Process Name:     -
 
Network Information:
                Workstation Name:        XXXXXX
                Source Network Address:            XXXXXX
                Source Port:                       30956
 
Detailed Authentication Information:
                Logon Process:                  NtLmSsp
                Authentication Package:               NTLM
                Transited Services:          -
                Package Name (NTLM only):       -
Key Length: 0

Note that the account name will have the format Aextest_<GUID>.

The actual Exchange mailbox account used is extest_<GUID>. This extra “A” is passed so that the test account does not get locked out.

This event can be ignored as it is by design. For further information, please open a support case at Microsoft.

This article applies to System Center Operations Manager 2012 and 2007 RTM, SP1 and R2.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.