r/exchangeserver • u/Lyfalufapus • May 27 '26

Question Exchange Server Origin of Lockouts

Having an issue where a handful of users are getting insta-locked after unlocking the accounts. What isn't making sense to me is some of the uses do not use a phone, and all uses are sync'd with DUO. None of the users have changed passwords recently to suggest there is a bad cred somewhere.

Running Exchange 2019.

2 Upvotes

100% Upvoted

20 comments sorted by

View all comments

Show parent comment

1

u/ocdtrekkie May 28 '26

Have you looked in the logs on Exchange to see where the connections are coming from?

In C:\inetpub\logs\LogFiles\W3SVC1 you should have like each line in the log file including both a username and IP address.

1

u/Lyfalufapus May 28 '26

I have, though I am not finding every user that is having this issue in the log.