audit failure logs for user "host"

Question

audit failure logs for user "host"

Md. Mohsin Reja 15

Hello, I am Md. Mohsin Reja. I am running an exchange 2016 server and have 2016 DC
recently we noticed in our AD-Audit Security logs Audit failed. user 'host' But no user 'host' in our environment. And our ADAudit Plus software Logs are attached.

Please find the following log information is where exchange servers are trying to authenticate through Kerberos as a username “host”. Please help us to get a reason and resolution regarding this issue.

MicrosoftTeams-image

MicrosoftTeams-image (1)

Regards,

Md. Mohsin Reja

Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2023-02-03T10:00:28.7933333+00:00

Hi @Md. Mohsin Reja ，

Just checking in to see how things are going on with this thread.

If the reply was helpful, you can click the "Accept Answer" button under this post so that other's with similar question can benefit from this thread as well.

If you still have further questions or concerns, feel free to post back.

1 answer

Your answer

Aholic Liang-MSFT 13,886 Reputation points Microsoft External Staff

2023-02-03T10:00:28.7933333+00:00

Hi @Md. Mohsin Reja ，

Just checking in to see how things are going on with this thread.

If the reply was helpful, you can click the "Accept Answer" button under this post so that other's with similar question can benefit from this thread as well.

If you still have further questions or concerns, feel free to post back.

Answer 1

Aholic Liang-MSFT 13,886 Microsoft External Staff

Hi @Md. Mohsin Reja ，

Regarding this Event ID: 4627, multiple users report experiencing the same issue:

event id 4768 - Microsoft Q&A

Event ID 4768 with error "0x6" - Microsoft Q&A

From the discussion, it can be seen that the error will not affect the environment. Therefore, if the server does not have other errors that affect usage, it is recommended that you can ignore this event.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread

William Fulmer 16 Reputation points

2023-02-10T14:35:45.25+00:00

@Md. Mohsin Reja - we have a customer experiencing a similar issue, with username 'host'.

Have you uncovered anything further with this?

Share via

audit failure logs for user "host"

1 answer

Your answer