Event ID 4625 is logged every 5 minutes when using the Exchange 2010 Management Pack in System Center Operations Manager

Article ID: 2591305 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

When using the Exchange 2010 Management Pack in System Center Operations Manager , you may receive a security audit failure event in the Security event log every 5 minutes. An example of the event is below:

Log Name: Security
Source:        Microsoft-Windows-Security-Auditing
Date:         
Event ID:      4625

Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      XXX

Description:
An account failed to log on.
 
Subject:
                Security ID:                         NULL SID
                Account Name:                 -
                Account Domain:                             -
                Logon ID:                             0x0
 
Logon Type:                                       3
 
Account For Which Logon Failed:
                Security ID:                         NULL SID
                Account Name:                 Aextest_39076b2bb6ec4
                Account Domain:                             XXXXXX
 
Failure Information:
                Failure Reason:                 Unknown user name or bad password.
                Status:                                  0xc000006d
                Sub Status:                         0xc0000064
 
Process Information:
                Caller Process ID:             0x0
                Caller Process Name:     -
 
Network Information:
                Workstation Name:        XXXXXX
                Source Network Address:            XXXXXX
                Source Port:                       30956
 
Detailed Authentication Information:
                Logon Process:                  NtLmSsp
                Authentication Package:               NTLM
                Transited Services:          -
                Package Name (NTLM only):       -
Key Length: 0

Note that the account name will have the format Aextest_<GUID>.

CAUSE

The actual Exchange mailbox account used is extest_<GUID>. This extra “A” is passed so that the test account does not get locked out.

RESOLUTION

This event can be ignored as it is by design. For further information, please open a support case at Microsoft.

MORE INFORMATION

This article applies to System Center Operations Manager 2012 and 2007 RTM, SP1 and R2.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.


Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Properties

Article ID: 2591305 - Last Review: July 9, 2012 - Revision: 6.0
APPLIES TO
  • Microsoft System Center Operations Manager 2007
  • Microsoft System Center Operations Manager 2007 R2
  • Microsoft System Center Operations Manager 2007 Service Pack 1
  • Microsoft System Center 2012 Operations Manager
Keywords: 
kbtshoot KB2591305

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com