Hi there Guys Hope you all are well I have a user that is currently working on a windows 7 pc, every 20mins his account locks out. I had a look at the Dc but that just points me to the exchange server had a look at the event id and this is what i get please see below. This problem is a on going problem is it the exchange server that locks the account? or is it a client that is trying to access the account?? what is Advapi? i know it has some thing to do with IIS??? Logon Failure: Reason: Unknown user name or bad password User Name: source Domain: Safe Logon Type: 8 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: EXCH-02 Caller User Name: EXCH-02$ Caller Domain: ALI Caller Logon ID: (0x0,0x3E7) Caller Process ID: 7588 Transited Services: - Source Network Address: 41.113.14.194 Source Port: 37027

The IP address you have posted belongs to a mobile phone provider. Therefore I would suspect that the user has entered their account details in to a mobile device, and then changed their password. Simon.Simon Butler, Exchange MVP Blog | Exchange Resources | In the UK? Hire Me.

Hi Santosh, Please check whether the IP address “41.113.14.194” is used by your Windows 7 PC. As far as I know, ADVAPI is the DLL for advanced windows api’s and is used in a lot of OS related code. When using logon Type 8 (NetworkCleartext), user need logon from within an ASP script using the ADAVAPI or logs on to IIS using IIS’s basic authentication mode. Some related documents for you, hope these help: Event Message: http://technet.microsoft.com/en-us/library/cc957091.aspx Error message when you try to view a Web site that is hosted on Internet Information Server 6.0 by using anonymous access: "401.1 Unauthorized: Logon failed" (Error 4) http://support.microsoft.com/kb/909887 Thanks, Evan Liu TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.