RE: event id 13004

[Allen Crawford]

Title: Message

We tracerouted it to some place in Cali by Orange and Santa Ana.  It just times out when it gets there.  I had my friend log into his account with POP3 and use an incorrect password to see what that error looked like—and it of course gives his login name and says incorrect username or bad password.  Because that was what I originally though it was too.  It does happen about once every minute as well.  Oh well…   -----Original Message----- From: Don Ely [mailto:[EMAIL PROTECTED]] Sent: Friday, November 30, 2001 2:27 PM To: MS-Exchange Admin Issues Subject: RE: event id 13004   Is it a constant connection attempt?  Have you tried tracerting to the address to see where it goes?  It's basically an authentication failure for someone trying to POP their mail.  Could be someone's PDA at home configured to try connecting to the server to download their mail.   Otherwise, dunno.  I would think you would see what account was failing its credentials.  I've never seen that specific error on any of my servers.   D     -----Original Message----- From: Allen Crawford [mailto:[EMAIL PROTECTED]] Sent: Friday, November 30, 2001 11:13 AM To: MS-Exchange Admin Issues Subject: RE: event id 13004 Yeah, that was the only article I found when searching.  We have no clue who or where the IP is coming from.  That's why I wondered if it could be a worm trying to do something or a hacker.  I've never seen this before on my server and no one is having problems with email on my friend's server.  Not that big of a deal since it doesn't seem to do anything other than fill up the log, but weird nonetheless.   -----Original Message----- From: Don Ely [mailto:[EMAIL PROTECTED]] Sent: Friday, November 30, 2001 1:56 PM To: MS-Exchange Admin Issues Subject: RE: event id 13004   Have you checked this article out?   http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q220905   So you know where that IP is coming from?  Remote user?      "There is nothing to fear but fear itself." -Franklin D. Roosevelt -----Original Message----- From: Allen Crawford [mailto:[EMAIL PROTECTED]] Sent: Thursday, November 29, 2001 7:01 AM To: MS-Exchange Admin Issues Subject: event id 13004 A friend of mine has the following error on his Exchange 5.5 Server.  Is this the work of one of the worms out there or a hacker or neither?  Also, is there an easy way to block this IP on the Exchange Server? Event ID: 13004 Source: MSExchange POP3 Logon attempt from 65.104.120.212 has failed: AcceptSecurityContext() call failed with error Access denied. List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm List Charter and FAQ at: http://www.sunbelt-software.com/exchange_list_charter.htm