Exchange IIS -- EventID: 4625 "Unknown user name or bad password"

  • An account failed to log on.

    Security ID: SYSTEM
    Account Name: Exchange Server$
    Account Domain: Domain
    Logon ID: 0x3E7

    Logon Type: 3

    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name:
    Account Domain:

    Failure Information:
    Failure Reason: Unknown user name or bad password.
    Status: 0xC000006D
    Sub Status: 0xC0000064

    Process Information:
    Caller Process ID: 0x10c8
    Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe

    Network Information:
    Workstation Name: Exchange Server
    Source Network Address: -
    Source Port: -

    Detailed Authentication Information:
    Logon Process: C
    Authentication Package: Kerberos
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0

    This just started yesterday at 9:00 AM. No changes have been applied as far as I can see. There is nothing listed for the account and as far as I can tell any service accounts are running as the local account. Caller Process Name points to IIS but....?

  • I'm reading that network scanning/platform management tools can cause this issue if they are setup to use a Guest account, but that does not seem to be the case here.

  • Service Provider

    bot hitting OWA?

  • @JaredBusch Going through the logs currently