Any event ids other than logons ? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dandy, Jim Sent: Tuesday, August 13, 2002 12:23 To: Exchange Discussions Subject: Service account logons - hacker?
Under what circumstances would a logon occur on the Exchange service account? I was looking through my event log and found that the service account logs on occasionally. Often it is between 2:00 AM and 3:30 AM but it doesn't occur every day and it doesn't appear to be closely associated with any particular event such as a system backup or reboot. I'm wondering if I have a hacker might be logging on using the service account? I changed the service account password yesterday and still got a logon last night at 3:11 AM. There were no failed logons. Thanks for your comments. Curt Finley _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
