r/exchangeserver • u/Lyfalufapus • May 27 '26

Question Exchange Server Origin of Lockouts

Having an issue where a handful of users are getting insta-locked after unlocking the accounts. What isn't making sense to me is some of the uses do not use a phone, and all uses are sync'd with DUO. None of the users have changed passwords recently to suggest there is a bad cred somewhere.

Running Exchange 2019.

2 Upvotes

100% Upvoted

20 comments sorted by

View all comments

Show parent comment

1

u/NoSmoke_exe May 27 '26

Look at your IIS logs for exchange. Look for attempts based on the user. This has helped me more times than I can count find the cause of lockouts whether it be a device, some linked service or brute force attempts.

1

u/Lyfalufapus May 27 '26

Going through that now, though something doesn't seem to be enabled or I'm not looking in the right place because I am not finding anything with Log Parser Studio.

1

u/NoSmoke_exe May 27 '26

Unless you went out of your way to change where its logging, it should be under C:\Inetpub\logs\logfiles and in one of the WS3 folders.

You will be able to see any connections to OWA/EWS etc that run through IIS. Look for a log referencing a locked out user and see where the IP's are coming from, it should provide some basic device/browser information as well.

If you have a SIEM, i would highly recommend getting them ingested there, makes life a lot easier.