Inbound authentication failed with error LogonDenied
James
for my emails server. Of the 2000 plus events, there is only three unique IP
address.
Event Type: Warning
Event Source: MSExchangeTransport
Event Category: SmtpReceive
Event ID: 1035
Date: 4/10/2008
Time: 8:41:34 PM
User: N/A
Computer: MAIL1
Description:
Inbound authentication failed with error LogonDenied for Receive connector
Default MAIL1. The authentication mechanism is Gssapi. The source IP address
of the client who tried to authenticate to Microsoft Exchange is
[64.163.147.26].
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
This is my default connector for my email server.
AuthMechanism : Tls, Integrated, BasicAuth,
BasicAuth
RequireTLS, ExchangeServer
Banner :
BinaryMimeEnabled : True
Bindings : {0.0.0.0:25}
ChunkingEnabled : True
DefaultDomain :
DeliveryStatusNotificationEnabled : True
EightBitMimeEnabled : True
DomainSecureEnabled : False
EnhancedStatusCodesEnabled : True
LongAddressesEnabled : False
OrarEnabled : False
Fqdn : mail1.*****.***
Comment :
Enabled : True
ConnectionTimeout : 00:10:00
ConnectionInactivityTimeout : 00:05:00
MessageRateLimit : unlimited
MaxInboundConnection : 5000
MaxInboundConnectionPerSource : unlimited
MaxInboundConnectionPercentagePerSource : 100
MaxHeaderSize : 64KB
MaxHopCount : 30
MaxLocalHopCount : 8
MaxLogonFailures : 3
MaxMessageSize : 10MB
MaxProtocolErrors : 5
MaxRecipientsPerMessage : 5000
PermissionGroups : AnonymousUsers, ExchangeUsers,
Exchan
geServers, ExchangeLegacyServers
PipeliningEnabled : True
ProtocolLoggingLevel : None
RemoteIPRanges : {0.0.0.0-255.255.255.255}
RequireEHLODomain : False
RequireTLS : False
EnableAuthGSSAPI : False
Server : MAIL1
SizeEnabled : EnabledWithoutValue
TarpitInterval : 00:00:05
AdminDisplayName :
ExchangeVersion : 0.1 (8.0.535.0)
Name : Default MAIL1
ObjectClass : {top, msExchSmtpReceiveConnector}
WhenChanged : 3/29/2008 8:52:39 PM
WhenCreated : 1/9/2008 10:23:29 PM
IsValid : True
I have check my default receive connector and I don’t see anything wrong.
I receive external emails from my hotmail account and the users are not
complaining either.
thanks James
Rich Matheisen [MVP]
>Over the last two week, I have been receiving couple thousand warning events
>for my emails server. Of the 2000 plus events, there is only three unique IP
>address.
64.163.147.26 is another Exchange server. Your machine probably
presents the XEXCH50 keyword (as does that other machine). Exchange
will try to authenticate and, of course, it will fail becasue the
other machine is in a different Exchange forest.
You can stop your Exchange server from doing that by following "Method
1" in http://support.microsoft.com/kb/818222. That won't do anything
for your problem but t'll stop your server from annoying other admins
with the same situation. :-)
--
Rich Matheisen
MCSE+I, Exchange MVP
MS Exchange FAQ at http://www.swinc.com/resource/exch_faq.htm
Don't send mail to this address mailto:h.p...@getronics.com
Or to these, either: mailto:h.p...@pinkroccade.com mailto:melvin.mcp...@getronics.com mailto:melvin.mcp...@pinkroccade.com
James
Exchange 2007 SP1
--
Thank You!
Rich Matheisen [MVP]
>I'm sorry I didn't specify which version of exchange I'm runing
>Exchange 2007 SP1
Do you see your server sending that keyword to external hosts? Check
the smtpsend log.
James
I don't see XEXCH50 in the SMTP send logs.
--
Thank You!
James
smpt logs.
Sorry I guess I needed to open my eyes:)
--
Thank You!
Rich Matheisen [MVP]
>Rich, I must have missed it on the first go through but, I do Xexch50 in the
>smpt logs.
>Sorry I guess I needed to open my eyes:)
If you have no Exchange 2003 servers you can turn off the XEXCH50
stuff in the set-transportconfig cmdlet.