Folks,I cannot nail down where or what the problem is. I am getting a constant barrage of 680 events against my DC. In this EVent, MAIL is our Exchange server (go figure!)Event Type: Failure AuditEvent Source: SecurityEvent Category: Account LogonEvent ID: 680Date: 2/16/2010Time: 1:19:48 PMUser: SYSTEMComputer: BANKPLUSDC01Description:Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: nc_user Source Workstation: MAIL Error Code: 0xC0000064 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: There is not now, nor has there ever been an "nc_user" account in our organization. Further, there are no supplemental services that are configured to use any external account for authentication. The only references to an "nc_user" account on the web relates to ZenWorks, which has also never been utilized on any system.Has anyone seen this before? Any suggestions on steps?Thanks in advance!

On Tue, 16-Feb-10 19:40:32 GMT, Dave Randall - ISA wrote:>>>Folks,I cannot nail down where or what the problem is. I am getting a constant barrage of 680 events against my DC. In this EVent, MAIL is our Exchange server (go figure!)Event Type: Failure AuditEvent Source: SecurityEvent Category: Account LogonEvent ID: 680Date: 2/16/2010Time: 1:19:48 PMUser: SYSTEMComputer: BANKPLUSDC01Description:Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: nc_user Source Workstation: MAIL Error Code: 0xC0000064 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. >>Data: >>There is not now, nor has there ever been an "nc_user" account in our organization. That's a good reason why you get the 0xC0000064 error (NO_SUCH_USER).:-)>Further, there are no supplemental services that are configured to use any external account for authentication. The only references to an "nc_user" account on the web relates to ZenWorks, which has also never been utilized on any system.Has anyone seen this before? Any suggestions on steps?Thanks in advance! Check your SMTP protocol logs and see if there are AUTH commands fromexternal sources.---Rich MatheisenMCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP