Event ID : 4740: Caller Computer Name: ExchangeServer

Question

_{Thursday, January 3, 2019 4:42 AM}

Hi experts i am getting the below event on my domain controller for many users. Caller Computer Name is showing as my Exchange server.  i have 2 mailbox servers for some users its exchange server01 for others its exchange server02. Below event is for one user J.Mark. experts guide me to resolve  this issue, why is it showing exchange server

A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: MYDC01$
Account Domain:MYDOMAIN
Logon ID: 0x3E7

Account That Was Locked Out:
Security ID: MYDOMAIN\J.Mark
Account Name: J.Mark

Additional Information:
Caller Computer Name: MYEXCHANGESRV01

All replies (6)

_{Thursday, January 3, 2019 6:11 AM ✅Answered}

If the authentication is hitting the DC right away (and not through another server like with NTLM passthrough), the event 4625 for the user on the DC will show the IP address of the device making the call. This requires that you have enabled at least the audit category: Logon/Logoff - Logon - Failure and eventually: Logon/Logoff - Account Lockout - Failure. But that can be very verbose.

_{Friday, January 4, 2019 7:00 AM ✅Answered}

Hi Risingflight,

From this article, we can know the define of "Caller Computer Name" is: the name of computer account from which logon attempt was received and after which target account was locked out.

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

_{Friday, January 4, 2019 10:32 PM ✅Answered}

If user is giving wrong password in outlook/owa or active sync ad due to that account getting locked out then it will always shows Exchange server name in logs. This is because authentication request goes via Exchange to AD.

Thanks, Ashish MCITP, MCT, MCSE

_{Friday, January 4, 2019 5:46 PM}

My question is Caller Computer is showing as exchange server in AD where the account is getting locked

_{Tuesday, January 8, 2019 2:18 AM}

Hi Risingflight，

Any update now？

If the above suggestion helps, please be free to mark it as an answer for helping more people.

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

_{Monday, January 14, 2019 9:37 AM}

Hi Risingflight，

Any update now?

If the above suggestion helps, please be free to mark it as an answer for helping more people.

Regards,

Kyle Xu

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.