We
tracerouted it to some place in Cali by Orange and Santa Ana. It just times out when it gets
there. I had my friend log into
his account with POP3 and use an incorrect password to see what that error
looked like-and it of course gives his login name and says incorrect username
or bad password. Because that was
what I originally though it was too.
It does happen about once every minute as well. Oh
well...
-----Original
Message-----
From: Don Ely
[mailto:[EMAIL PROTECTED]]
Sent: Friday, November 30, 2001 2:27
PM
To: MS-Exchange Admin
Issues
Subject: RE: event id
13004
Is it a constant
connection attempt? Have you tried tracerting to the address to see
where it goes? It's basically an authentication failure for someone
trying to POP their mail. Could be someone's PDA at home configured to
try connecting to the server to download their mail.
Otherwise,
dunno. I would think you would see what account was failing its
credentials. I've never seen that specific error on any of my
servers.
D
-----Original
Message-----
From: Allen
Crawford [mailto:[EMAIL PROTECTED]]
Sent: Friday, November 30, 2001 11:13
AM
To: MS-Exchange Admin
Issues
Subject: RE: event id
13004
Yeah,
that was the only article I found when searching. We have no clue who or where the IP is
coming from. That's why I
wondered if it could be a worm trying to do something or a hacker. I've never seen this before on my
server and no one is having problems with email on my friend's server. Not that big of a deal since it
doesn't seem to do anything other than fill up the log, but weird
nonetheless.
-----Original
Message-----
From: Don Ely
[mailto:[EMAIL PROTECTED]]
Sent: Friday, November 30, 2001 1:56
PM
To: MS-Exchange Admin
Issues
Subject: RE: event id
13004
Have you
checked this article out?
http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q220905
So you know where
that IP is coming from? Remote user?
"There is
nothing to fear but fear itself." -Franklin D. Roosevelt
-----Original
Message-----
From: Allen
Crawford [mailto:[EMAIL PROTECTED]]
Sent: Thursday, November 29, 2001 7:01
AM
To: MS-Exchange Admin
Issues
Subject: event id
13004
A friend of mine has
the following error on his Exchange 5.5 Server. Is this the work of one
of the worms out there or a hacker or neither? Also, is there an easy
way to
block this IP on the
Exchange Server?
Event ID:
13004
Source: MSExchange
POP3
Logon attempt from
65.104.120.212 has failed: AcceptSecurityContext() call failed with error
Access denied.
List Charter and FAQ
at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter
and FAQ
at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ
at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List Charter and FAQ
at:
http://www.sunbelt-software.com/exchange_list_charter.htm
List
Charter and FAQ
at: