I had a bizarre instance this morning and I'm hoping someone can help me shed some light as to what's happened.

A user complained about being locked out this morning. After resetting the password, we noticed that the account was almost instantaneously locked out again. We looked through the audit logs to discover the requests were coming from our Exchange server - something I had never really seen before.

We looked through the OWA logs to discover that there were no entries in there corresponding to that username. We disabled OWA, ActiveSync, MAPI, etc and the account continued to be locked out.

After looking through the event viewer logs on the Exchange server, we came across this entry.

Inbound authentication failed with error LogonDenied for Receive connector Default EMAILSERVER. The authentication mechanism is Login. The source IP address of the client who tried to authenticate to Microsoft Exchange is [XX.XX.XX.XX].

With nowhere left to turn, we black-hole'd the traffic from that IP address and the account lockouts ceased. This was a public IP address that resolved to a country where I would not expect to receive much mail from.

My questions are :

  • How was this IP address attempting to authenticate? I can't see anything in my logs that would make any sense to me as to the vector which they tried to log in.
  • How can I prevent this from happening in the future? This is Exchange 2010 SP3 and unfortunately Edge Transport is not a viable option at this point :(
  • Hello which Event logs did you see this entry on ? – user242895 Sep 17 '14 at 21:51

"Receive connector" means SMTP. Look at your transport connector logs.

Unless you have a good reason to, you shouldn't let Exchange users authenticate to an external SMTP connector. That would stop this problem from happening.

You should have:

  • One receive connector dedicated to receiving email from the internet with just TLS (and possibly Mutual TLS Auth) turned on.

If you have anything else that needs SMTP, then you should have more connectors:

  • If you have devices inside your network (like copiers/scanners) that need to send to your users, then you should have a connector for that. This should have TLS and auth enabled but restricted to a specific service account.
  • If you have internal devices that don't support auth or TLS, then another connector should be configured with IP restrictions.
  • External users that need to send via authenticated SMTP should be on a different port (usually 587) and required to use TLS.
  • So disable TLS, Basic Auth, Exchange Server Auth, Intregrate Windows Auth? – DKNUCKLES Apr 17 '14 at 15:13
  • I edited my answer to include some best practices of receive connector configuration. – longneck Apr 17 '14 at 15:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.