Logon Failure "\" registered on local Exchange server as Event 4625; paired with Domain Controller registered event 4776 for same email account

dougsymes1234

We're seeing this pair of Windows Security events every second or two against a user's account. 

Name: UserLogonFailure

ProviderSID: "Windows-Security-Auditing" <Event>

Severity: 4

1) Event 4776 

    EVENT INFO: [Account "<username>@&lt;domain>" used for login failed from "<workstation>" 

    ExtraneousInfo: Error Code: 0xc000006a Error: user name is correct but the password is wrong

    Failure Reason: [user name is correct but the password is wrong]

    Detection IP: <Domain Controller>.<domain-name>

    AuthPackage: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

2) Event 4625

    EVENT INFO: [Logon Failure "\<Username>@&lt;domain>"] - Failure Reason: Unknown user name or bad password.

    ExtraneousInfo: SourcePort: <random-port>; Call-ProcessName: -;

    Failure Reason: Unknown user name or bad password. 

    Detection IP: <Exchange Server>.<domain-name>

We use Azure AD Sync to link our AD to AzureAD.  Not sure how that could cause this however.

npatterson

Check the users computer and credential manager and have them delete the saved password for servers.  If there is a incorrect password store for example SMB share it will fail and ask them to re enter the correct details while not updating the stored password I had this several times with other people have recent password change.