Exchange IIS -- EventID: 4625 "Unknown user name or bad password"
An account failed to log on.
Security ID: SYSTEM
Account Name: Exchange Server$
Account Domain: Domain
Logon ID: 0x3E7
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Failure Reason: Unknown user name or bad password.
Sub Status: 0xC0000064
Caller Process ID: 0x10c8
Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe
Workstation Name: Exchange Server
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: C
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This just started yesterday at 9:00 AM. No changes have been applied as far as I can see. There is nothing listed for the account and as far as I can tell any service accounts are running as the local account. Caller Process Name points to IIS but....?
I'm reading that network scanning/platform management tools can cause this issue if they are setup to use a Guest account, but that does not seem to be the case here.
bot hitting OWA?
@JaredBusch Going through the logs currently