I am pulling my hair out on this one. I've been trying to complete a 2010->2013 migration, but this problem is holding me up.
Something is triggering bad password events when an Outlook client configures itself, and because our password policy only allows 3 bad passwords, accounts with mailboxes on our new 2013 servers are locking up frequently. (I should say I *think* this
is the cause, but it is hard to track down.) This is not happening to accounts still on the 2010 servers.
I have run everything on testconnectivity.microsoft.com, and that all checks out. It seems that this only occurs when the user's UPN matches the e-mail address, which is the case for most users in our environment. If I change the user's UPN to something
else, the problem does not occur.
I downloaded the Microsoft Connectivity Analyzer tool from the testconnectivity site, and I can trigger the issue by running the "I am experiencing other problems with Outlook" test while Outlook is open on the machine. If I then use the UPN
for the account in the dialogue, the account locks out when the test starts to run. If I use DOMAIN\user format, no lockout occurs.
I can also trigger the event by creating several Outlook profiles in a row, since every new profile creation seems to trigger a bad password event. This is on a domain computer, and this does not (and should not) ask for the password. Outlook does
configure correctly and open the mailbox (assuming the account hasn't locked out yet). Running "Test E-mail Auto-configuration" from an Outlook client does NOT trigger the event.
The bad password events are occurring on the Exchange server itself. I have enabled netlogon debugging, and I don't see any failure events for the account in the netlogon.log file, either on the Exchange servers or on the DCs. Here is an example
of a bad password event, though I should say I am not even sure this is what's triggering the lockout since I can't find any failure events on any of my DCs:
An account failed to log on.
Subject:
Security ID:
SYSTEM
Account Name:
ExchangeServer1$
Account Domain:
MYDOMAIN
Logon ID:
0x3E7
Logon Type:
8
Account For Which Logon Failed:
Security ID:
NULL SID
Account Name:
testz@mydomain.com
Account Domain:
Failure Information:
Failure Reason:
Unknown user name or bad password.
Status:
0xC000006D
Sub Status:
0xC000006A
Process Information:
Caller Process ID:
0xd60
Caller Process Name:
C:\Windows\System32\inetsrv\w3wp.exe
Network Information:
Workstation Name:
ExchangeServer1$
Source Network Address:
10.0.0.70
Source Port:
12326
Detailed Authentication Information:
Logon Process:
Advapi
Authentication Package:
Negotiate
Transited Services:
-
Package Name (NTLM only):
-
Key Length:
0
What the heck am I missing?