Exchange IIS -- EventID: 4625 "Unknown user name or bad password"

wirestyle22

An account failed to log on.

Subject:
Security ID: SYSTEM
Account Name: Exchange Server$
Account Domain: Domain
Logon ID: 0x3E7

Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name:
Account Domain:

Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064

Process Information:
Caller Process ID: 0x10c8
Caller Process Name: C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
Workstation Name: Exchange Server
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: C
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This just started yesterday at 9:00 AM. No changes have been applied as far as I can see. There is nothing listed for the account and as far as I can tell any service accounts are running as the local account. Caller Process Name points to IIS but....?

wirestyle22

I'm reading that network scanning/platform management tools can cause this issue if they are setup to use a Guest account, but that does not seem to be the case here.

JaredBusch

bot hitting OWA?

wirestyle22

@JaredBusch Going through the logs currently