IR Exchange?

[kathanon]

Hello, I wonder if anyone can shed light on this.

I am getting error 681 in the security event log. It says that the logon to account IR-Exchange$ by Microsoft Authentication Package V! 0 from workstation IR exchange failed. The error code was 3221225572

When I look the error code up it tells me that it is a bad account, but I am not sure what is happening or whether I need to do anything.

Can anyone help please?

Many thanks

Kathy

 

[GiaBetiu]

It seems that the account doesn't exist.
Beeing with "$" sign, I suppose that is a computer account.
Computer account from that computer,, dissapeared (removed) or never existed.
Is the "IR-exchange" computer joined to the domain?

Gia Betiu
gia@almondeyes.net
Computer Eng. CNE 4, CNE 5, MCSE Win2K
new:

http://www.almondeyes.net

(just started)

 

[kathanon]

Hi

No, we have no such computer, and never had one of that name.

I am wondering if it is connected with the receiving of email from certain people and will check the times of the error against email today. It does seem that sometimes when we get email from certain servers it gives an error message in the event log under security. That was what I was hoping to understand better and to correct if necessary.

Thanks

Kathy

 

[GiaBetiu]

So,.. you don't know any system connected there that has that name?
What the error is saying is that a request is comming from a computer that is authenticated itself as IR-Exchange$.

So, ndeed try to track to see in which conditions the error apear.

Gia Betiu
gia@almondeyes.net
Computer Eng. CNE 4, CNE 5, MCSE Win2K
new:

http://www.almondeyes.net

(just started)

 

[brontosaurus]

Hi Kathy, is it possible that someone in the company was trying to access your server with a home machine? Do you allow remote access?

 

[kathanon]

Hi brontosaurus, thank you for answering, hope you are well.

The only remote access we have is to Outlook web access.

What does interest me is that the same error messages occur when we receive email from another organisation. I always see the name of the other organisation as trying to log on to our server, but it is when an email arrives.

I am puzzled, apart from that the only remote access we have is VNC, which is not running permanently and is also restricted to two IP addresses on by the firewall.

Thank you

Kathy