SEM - Exchange Log Login Failure - Need the Source IP Address

rhess

I get many events of "UserLoginFailure" referencing accounts that are no longer active or erroneous accounts.  They all are logon failures to my on-premises exchange server.  The "FailureReason" is "Unknown user name or bad password".  The SEM logs are always showing the source machine as being my exchange server, however the source is coming from an external ip address, although I can't find that IP Address in the exchange application logs, which I do have integrated to SEM. Logon Process is Advapi.  Need help identifying the actual source ip address.

npatterson

I know this is very delay in response but the should be checking the windows security log not application logs as it related to login.  I assume that the account Active directory as this is a exchange server.   That being said does the external IP consistence might have been a smtp relay server set with the user account. 

Please understand Userloginfailure is general look for more log form the same source IP and time frame to find other logs because for exchange check the tool alias to see which connector is picking up alert.  This will help you narrow done your search. 

Hope that helps