Hi, I have a setup of 2 Mailbox (with DAG) and 2 CAS servers running Exchange 2010. The setup is performed using my user account. Recently a change of password has caused my account to be continuously being locked out. From much troubleshooting, I've pinpoint it to the Application Pool "DefaultAppPool" where the RPC and RPCwithCert are using. Once I've disabled the Application Pool, DefaultAppPool, my lockout problems are solved. I'm wondering if there's logs for RPC/RPCWithCert Virtual Directory of the DefaultAppPool which I can look at to find out more about the lockout. As I do not use the Outlook Anywhere feature, should I remove the RPC and RPCWithCert. Any tools that can log w3wp.exe logons so I can pinpoint the faulting client (if any). Thank you in advance...

Is Outlook Anywhere enabled on the server? It is just HTTP traffic, so would be logged by standard IIS logs. You just need to go through the logs to find the authentication details and then the IP address that they are coming from. Simon. Simon Butler, Exchange MVP Blog | Exchange Resources | In the UK? Hire Me.

Hi Chua, Per your description, I want to verify some information: 1. Does any other users have the same issue? 2. Which password did you change before the issue occurred? 3. Did you run the EXBPA to retrieve some information? If so, please post some usful information here. And, I would not disabled the application pool, because there some web services is required by the clients, either the outlook end or the OWA end. In my opinion, it seems the CERT of the exchange server have some issue, and cause the clients could not be authenticated by the server. Regards! Gavin TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

I have found that my account is coded into the OAB virtual directory thus causing the lockout. It was traced by going through the web.config file in the application pool temp folder which is usually in C:\Inetpub\Temp\AppPools\.... Thank you for all your help.