Share via

TLS Auth causes account login failure audits (Event ID 36879)

Cory C 11 Reputation points
2021-03-19T16:47:52.743+00:00

Exchange Experts,

I can't eliminate an 'account failed to log on' audit caused by exchange's TLS auth mechanism. Everytime I get an email delivered to the server via our receive connector, the server tries to match the sender's cert using NTLM (I think).

I can't fix it regardless of the security options I select on the receive connector. It looks like exchange's TLS is trying to map the sending server's certificate to a machine or system account, which won't work. It must be a built in mechanism of Windows TLS?

Can anyone help get this to stop trying to match it to system accounts or point me in the right direction?

EDIT: Environment: Server 2019, Exchange 2019 CU8

References

  1. AUDIT LOG ENTRY ON EXCHANGE SERVER An account failed to log on. Subject:
    Security ID: S-1-0-0
    Account Name: -
    Account Domain: -
    Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed:
    Security ID: S-1-0-0
    Account Name:
    Account Domain: Failure Information:
    Failure Reason: An Error occured during Logon.
    Status: 0xC000006D
    Sub Status: 0x80090325 Process Information:
    Caller Process ID: 0x0
    Caller Process Name: - Network Information:
    Workstation Name: -
    Source Network Address: -
    Source Port: - Detailed Authentication Information:
    Logon Process: Schannel
    Authentication Package: Microsoft Unified Security Protocol Provider
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request.
    • Transited services indicate which intermediate services have participated in this logon request.
    • Package name indicates which sub-protocol was used among the NTLM protocols.
    • Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
  2. SCHANNEL LOG IN SYSTEM LOG The certificate received from the remote client application was not successfully mapped to a client system account. The error code is 0xC000006D. This is not necessarily a fatal error, as the server application may still find the certificate acceptable.

System Log / Source schannel / Event ID 36879

  1. EXCHANGE RECEIVE CONNECTOR SETTINGS RunspaceId : 84e2514a-91f6-4fee-ab6f-3acfe6e4edb8
    AuthMechanism : Tls
    Banner :
    BinaryMimeEnabled : True
    Bindings : {[::]:25, 0.0.0.0:25}
    ChunkingEnabled : True
    DefaultDomain :
    DeliveryStatusNotificationEnabled : True
    EightBitMimeEnabled : True
    SmtpUtf8Enabled : True
    BareLinefeedRejectionEnabled : False
    DomainSecureEnabled : True
    EnhancedStatusCodesEnabled : True
    LongAddressesEnabled : False
    OrarEnabled : False
    SuppressXAnonymousTls : False
    ProxyEnabled : False
    AdvertiseClientSettings : False
    Fqdn : mail.c3.%MyFQDM%.com
    ServiceDiscoveryFqdn :
    TlsCertificateName : <I>CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, S=Greater Manchester,
    C=GB<S>CN=mail.c3.%MyFQDM%.com
    Comment :
    Enabled : True
    ConnectionTimeout : 00:10:00
    ConnectionInactivityTimeout : 00:05:00
    MessageRateLimit : Unlimited
    MessageRateSource : IPAddress
    MaxInboundConnection : 5000
    MaxInboundConnectionPerSource : 20
    MaxInboundConnectionPercentagePerSource : 2
    MaxHeaderSize : 256 KB (262,144 bytes)
    MaxHopCount : 60
    MaxLocalHopCount : 12
    MaxLogonFailures : 3
    MaxMessageSize : 36 MB (37,748,736 bytes)
    MaxProtocolErrors : 5
    MaxRecipientsPerMessage : 200
    PermissionGroups : AnonymousUsers
    PipeliningEnabled : True
    ProtocolLoggingLevel : Verbose
    RemoteIPRanges : {65.55.88.0/24, 94.245.120.64/26, 207.46.51.64/26, 207.46.163.0/24, 213.199.154.0/24, 213.199.180.128/26,
    2a01:111:f400:7c00::/54, 23.103.132.0/22, 23.103.136.0/21, 104.47.0.0/17, 23.103.198.0/23, 23.103.200.0/21,
    2a01:111:f400:fc00::/54, 65.55.169.0/24, 134.170.140.0/24, 134.170.171.0/24...}
    RequireEHLODomain : False
    RequireTLS : True
    EnableAuthGSSAPI : False
    ExtendedProtectionPolicy : None
    LiveCredentialEnabled : False
    TlsDomainCapabilities : {mail.protection.outlook.com:AcceptCloudServicesMail}
    Server : C3-CARM-EXCH
    TransportRole : FrontendTransport
    RejectReservedTopLevelRecipientDomains : False
    RejectReservedSecondLevelRecipientDomains : False
    RejectSingleLabelRecipientDomains : False
    AcceptConsumerMail : False
    SizeEnabled : Enabled
    TarpitInterval : 00:00:05
    AuthTarpitInterval : 00:00:05
    MaxAcknowledgementDelay : 00:00:30
    AdminDisplayName :
    ExchangeVersion : 0.1 (8.0.535.0)
    Name : Default Frontend C3-CARM-EXCH
    DistinguishedName : CN=Default Frontend C3-CARM-EXCH,CN=SMTP Receive Connectors,CN=Protocols,CN=C3-CARM-EXCH,CN=Servers,CN=Exchange
    Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=C3,CN=Microsoft
    Exchange,CN=Services,CN=Configuration,DC=C3,DC=%MyFQDM%,DC=LOCAL
    Identity : C3-CARM-EXCH\Default Frontend C3-CARM-EXCH
    Guid : ccd41531-2e07-4158-b033-c8e0a2e82aa7
    ObjectCategory : C3.%MyFQDM%.LOCAL/Configuration/Schema/ms-Exch-Smtp-Receive-Connector
    ObjectClass : {top, msExchSmtpReceiveConnector}
    WhenChanged : 3/19/2021 11:42:50 AM
    WhenCreated : 2/28/2021 5:07:17 PM
    WhenChangedUTC : 3/19/2021 3:42:50 PM
    WhenCreatedUTC : 2/28/2021 10:07:17 PM
    OrganizationId :
    Id : C3-CARM-EXCH\Default Frontend C3-CARM-EXCH
    OriginatingServer : C3-CARM-DC.C3.%MyFQDM%.LOCAL
    IsValid : True
    ObjectState : Unchanged
  2. SMTP PROTOCOL LOG 220 mail.c3.%MyFQDN%.com Microsoft ESMTP MAIL Service ready at Fri, 19 Mar 2021 11:34:52 -0400
    EHLO NAM04-CO1-obe.outbound.protection.outlook.com
    250 mail.c3.%MyFQDN%.com Hello [104.47.45.54] SIZE 37748736 PIPELINING DSN ENHANCEDSTATUSCODES STARTTLS 8BITMIME BINARYMIME CHUNKING SMTPUTF8
    STARTTLS
    220 2.0.0 SMTP server ready
    CN=mail.c3.%MyFQDN%.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB 0083FCA8E4520287D092B34DFB87FC2C6C 6185A6B241DE02FCD5DEAA247130D947F912D04F 2020-04-14T20:00:00.000Z 2022-07-17T20:00:00.000Z mail.c3.%MyFQDN%.com;autodiscover.%MyFQDN%.com;www.%MyFQDN%.com Sending certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names
    CN=mail.protection.outlook.com, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=DigiCert Cloud Services CA-1, O=DigiCert Inc, C=US 0700204CC3051A9ED4F65599C48E742C 5D440E75FE29C4D5A223314BB0EC1DCBEB1A0903 2021-02-05T19:00:00.000Z 2022-02-05T18:59:59.000Z mail.protection.outlook.com;.mail.eo.outlook.com;.mail.protection.outlook.com;mail.messaging.microsoft.com;outlook.com;.olc.protection.outlook.com;.pamx1.hotmail.com Remote certificate Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names
    TLS protocol SP_PROT_TLS1_2_SERVER negotiation succeeded using bulk encryption algorithm CALG_AES_256 with strength 256 bits, MAC hash algorithm CALG_SHA_384 with strength 0 bits and key exchange algorithm CALG_ECDH_EPHEM with strength 384 bits
    EHLO NAM04-CO1-obe.outbound.protection.outlook.com
    CN=mail.protection.outlook.com, O=Microsoft Corporation, L=Redmond, S=Washington, C=US CN=DigiCert Cloud Services CA-1, O=DigiCert Inc, C=US 0700204CC3051A9ED4F65599C48E742C 5D440E75FE29C4D5A223314BB0EC1DCBEB1A0903 2021-02-05T19:00:00.000Z 2022-02-05T18:59:59.000Z mail.protection.outlook.com;.mail.eo.outlook.com;.mail.protection.outlook.com;mail.messaging.microsoft.com;outlook.com;.olc.protection.outlook.com;.pamx1.hotmail.com Validated received certificate (cached) Subject Issuer name Serial number Thumbprint Not before Not after Subject alternate names
    TlsDomainCapabilities='AcceptCloudServicesMail'; Status='Success'; Domain='mail.protection.outlook.com'
    SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders Set Session Permissions
    250 mail.c3.%MyFQDN%.com Hello [104.47.45.54] SIZE 37748736 PIPELINING DSN ENHANCEDSTATUSCODES 8BITMIME BINARYMIME CHUNKING SMTPUTF8 XOORG
    MAIL FROM:<ccandia@%MyFQDN%.com> SIZE=33012 XOORG=%MyFQDN%.com
    SMTPAcceptAnyRecipient SMTPAcceptAuthoritativeDomainSender BypassAntiSpam BypassMessageSizeLimit Granted Mail Item Permissions
    08D8EAE82C60FCAA;2021-03-19T15:34:53.220Z;1 receiving message
    RCPT TO:<tkickass@%MyFQDN%.com>
    250 2.1.0 Sender OK
    250 2.1.5 Recipient OK
    BDAT 22895 LAST
    Set mail item OORG to '%MyFQDN%.com' based on 'MAIL FROM:'
    Proxy destination(s) obtained from OnProxyInboundMessage event. Correlation Id:ddffa6c1-5c87-43e1-aea4-2e6f2dff102b
    250 2.6.0 <DM6PR10MB3163472928DF2ABFA297AF61B9689@DM6PR10MB3163.namprd10.prod.outlook.com> [InternalId=1679332212747, Hostname=C3-CARM-EXCH.C3.%MyFQDN%.LOCAL] 24433 bytes in 0.147, 161.380 KB/sec Queued mail for delivery
    QUIT
    221 2.0.0 Service closing transmission channel
  3. What Microsoft says about it:
    dn786445(v=ws.11)
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,627 questions

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Xzsssss 8,871 Reputation points Microsoft Vendor
    2021-03-22T08:59:20.837+00:00

    Hi @Cory C ,

    Sorry that I don't quite understand the issue, and you said this caused the accounts logon failure, logging on to OWA/ECP or clients?
    And the mail flow is good?
    If you don't mind, restore the Connectors to the default status and check. And I'm thinking the Exchange Server is necessary member of the group list.
    80138-image.png

    Regards,
    Lou

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  2. Cory C 11 Reputation points
    2021-03-22T13:36:49.297+00:00

    Mail flow is fine, partially. Mail flows in and out of the environment.

    The issue is specific to SMTP delivery using TLS.

    When our upstream sending server (office 365) connects to the on prem exchange server, we require TLS. When SMTP does the TLS process and the certificates are exchanged, it works and allows encrypted mail transfer, but Windows Server 2019 seems to try and use the sending server's certificate attempting to match a local or domain user account. That's what causes the login failure audit.

    We don't want exchange to attempt to match another SMTP server's certificate to an account, we just want the SMTP session encrypted. I didn't notice this behavior on Server 2012 R2 with Exchange 2013. Not saying it wasn't doing it, but we never got the monitoring system blowing up about failed logins, so I am guessing not.

    P.S. When you do TLS, you need to match the public certificate name like mail.FQDN.com, which will not work when you select 'Exchange Server Authentication'. I reset the receive connector back to mostly original. We have tried all different options trying to prevent the user account cert match (event ID 36879)
    80199-receiveconnectorsecurity.png

    0 comments
  3. Cory C 11 Reputation points
    2021-03-23T00:19:43.683+00:00

    Dude! I know, right! (In agreement with you Andy). I shouldn't have to have any of that other stuff checked, but even Microsoft scripted tech support wants all that crap on there. I doesn't make any sense to me either.

    More importantly, I have also tried exactly that configuration, but it still gives the same errors. Very frustrating.

    This is a quote from the Microsoft site about the error (event 36879):

    When a server application requires client authentication, Schannel automatically attempts to map the certificate supplied by the client to a user account.

    I think Windows Server / Exchange is passing the sending server's cert to LSASS trying to match an account. I can't prove that, but it's what the blurb says, and it makes sense with the error messages. I just can't find anything about it, or turn it off. I can't imagine there is something that unique about my installation of Server 2019 / Exchange CU8. That has to happen to other people right?

  4. Andy David - MVP 147.8K Reputation points MVP
    2021-03-25T17:06:16.383+00:00

    You are going to hate this suggestion.
    Add this registry key and silence the events :)

    Set-itemproperty HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel -Name EventLogging -Value 0

    I mean, otherwise, its working right?

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.