Could this be from his Blackberry?

[JBruyet]

Hey all,

I'm getting the following error in my event log every 15 minutes:

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 8/1/2008
Time: 5:53:14 AM
User: NT AUTHORITY\SYSTEM
Computer: SRV-EXCHANGE2K7
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: richard
Source Workstation:
Error Code: 0xC0000064

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

My General Manager has a Blackberry and I'm thinking this is related to the error. The error code of 0xC000064 per Microsoft means that "The account does not exist." Um, my General Manager DOES have an account. Could it be a configuration error on his Blackberry? Anyway, I thought I'd post this here before I posted it in the Blackberry forum. Has anyone ever "corrected" this error? Any help would be greatly appreciated.

Thanks,

Joe

 

[Davetoo]

Do you have a BES? How is his BB configured?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[xmsre]

0xC0000064 means no such user. Most likely a misconfigured POP3 account (at least something that you'd manually mangle the credentials with).

 

[Zelandakh]

Not a BB. That would use the BES Admin account.

 

[JBruyet]

Sorry for the long delay. I had him check his Blackberry and he said that there are no incorrect accounts--all three are working fine. The only other device he's using is his laptop and I just checked it out. It's setup with one account and that one account is set up correctly. Are there any diagnostic tools available in Exchange that might list the MAC address of the "offending" device along with the error? That would be a HUGE help.

Thanks,

Joe B

 

[xmsre]

Turn on smtp logging. I've seen this happen when a user attempts to relay and they're not allowed. Hmmm...

" no incorrect accounts--all three are working fine. "

What exactly does that mean? Why are there 3 accounts? What are the three accounts?

 

[JBruyet]

xmsre, the first account is for his "remote access" to the Exchange server, the second account is his home account, and I believe his third account is either a GMail or a Yahoo account. As I mentioned above, he says all of his accounts are working fine.

I'll try turning on SMTP logging and see if that gives me any illumination on this issue.

Thanks,

Joe B

 

[xmsre]

and I believe his third account is either a GMail or a Yahoo account. "

I bet it tries to send through exchange first. Since you can't relay for yahoo, you'd get the 680. Turn on your SMTP logging and verify.

 

[JBruyet]

I'm can't see how to turn on SMTP logging. i keep reading about Edge Transport but I'm looking in my Exchange Management Console right now and none of the "Configuration" options list anything about Edge Transport. How do I enable SMTP logging?

Thanks,

Joe B

 

[xmsre]

http://technet.microsoft.com/en-us/library/aa997624.aspx

for smtp

http://technet.microsoft.com/en-us/library/aa997690.aspx

for pop3 and imap4