Account lockout

Question

Hi,

We are currently in the process of moving our local Exchange accounts over to Office 365 via staged migrations. A number of mailboxes have been moved across successfully and end users are connecting without issues.

Recently, the account which is used in the Migration Endpoint settings is being constantly locked out with requests at the rate of 2-3 per second. The event log on our local front end exchange servers shows the following event:

Event Type: Failure Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 539

Date:  22/04/2016

Time:  11:16:07

User:  NT AUTHORITY\SYSTEM

Computer: localexchange

Description:

Logon Failure:

  Reason:  Account locked out

  User Name: *localaccount*

  Domain: ds9

  Logon Type: 3

  Logon Process: NtLmSsp

  Authentication Package: NTLM

  Workstation Name: DBXPR05MB078

  Caller User Name: -

  Caller Domain: -

  Caller Logon ID: -

  Caller Process ID: -

  Transited Services: -

  Source Network Address: 132.245.210.76

  Source Port: 63023

I have checked the Migration page online and ensured that all batches have status of stopped. I have also amended the Endpoint settings and replaced the local account with a dummy account which doesn't exist but the local front end server is still being hammered with requests. It would appear that some process is still running on the cloud Office 365 and connecting to our local server.

I have also used powershell to connect to Office 365. It only reports the same as the online portal with all batched stopped and only the one migration endpoint.

Can anyone advise how I can stop office 365 connecting to us.

Thanks

Answer 1

Hi Villains,

Please use admin credentials to Connect to Exchange Online using remote PowerShell,

Then type Remove-MigrationBatch -Identity *** to delete all batches one by one. In this way, Office 365 will not contact your local server.

Then you may need to unlock the admin account in local. If the issue persists, you may post the issue in our Exchange Server Forum for dedicated assistance.

Regards,

Brook