Hi All,
Thanks for stopping by.
I work for a company that supports over 70 ipads, both ipad1 & ipad2. We have all staff members accessing the exchange mail server using the Mail client.
Recently on several occassions, the CEO could not receive his emails and has been prompted to enter his password. He is using an ipad2 with iOS 5.01.
At first we thought he changed his password at the computer and forgot to update the ipad, but after the second and third time it happened, we realised there was something strange happening.
With further investigation we discovered 10 security log entries on the DC server with the following Event Properties all with the same time stamp to the second:
Date: 06/01/2012 Source: Security
time: 14:45:23 Category: Account Logon
Type: Failed Aud Event ID: 675
User: NY AUTHORITY\SYSTEM
Computer: CRSDC05
Pre-authentication failed:
User Name: xyz
User ID: MyCompany\xyz
Service Name: kbtgt/MyCompany
Pre-Authentication Type: 0x2
Failure Code: 0x12
Client Address: 192.168.68.6
The 192.168.68.6 ip address points to the OWA server (i.e CRSOWA03). On the OWA server the network admin was able to retrieve the following information showing that the ipad Mail app had caused the account to lock out.
2012-01-06 14:45:22 W3SVC100 CRSOWA03 192.168.68.13 OPTIONS /Microsoft-Server-ActiveSync - 443 MyCompany\xyz 87.127.24.103 HTTP/1.1 Apple-iPad2C2/901.405 - - mail.mycompany.net 401 1 1909 298 302 0The strange thing is that the CEO did not change his password and the password was not due to expire for another 2 weeks. He was able to access his emails from his ipad that morning.
Does anyone know if this is an ios 5.01 issue. We've already tried replacing the ipad and it doesn't look like a hardware issue.
Thanks for your help.
Regards,
Yohanna
Thanks for stopping by.
I work for a company that supports over 70 ipads, both ipad1 & ipad2. We have all staff members accessing the exchange mail server using the Mail client.
Recently on several occassions, the CEO could not receive his emails and has been prompted to enter his password. He is using an ipad2 with iOS 5.01.
At first we thought he changed his password at the computer and forgot to update the ipad, but after the second and third time it happened, we realised there was something strange happening.
With further investigation we discovered 10 security log entries on the DC server with the following Event Properties all with the same time stamp to the second:
Date: 06/01/2012 Source: Security
time: 14:45:23 Category: Account Logon
Type: Failed Aud Event ID: 675
User: NY AUTHORITY\SYSTEM
Computer: CRSDC05
Pre-authentication failed:
User Name: xyz
User ID: MyCompany\xyz
Service Name: kbtgt/MyCompany
Pre-Authentication Type: 0x2
Failure Code: 0x12
Client Address: 192.168.68.6
The 192.168.68.6 ip address points to the OWA server (i.e CRSOWA03). On the OWA server the network admin was able to retrieve the following information showing that the ipad Mail app had caused the account to lock out.
2012-01-06 14:45:22 W3SVC100 CRSOWA03 192.168.68.13 OPTIONS /Microsoft-Server-ActiveSync - 443 MyCompany\xyz 87.127.24.103 HTTP/1.1 Apple-iPad2C2/901.405 - - mail.mycompany.net 401 1 1909 298 302 0The strange thing is that the CEO did not change his password and the password was not due to expire for another 2 weeks. He was able to access his emails from his ipad that morning.
Does anyone know if this is an ios 5.01 issue. We've already tried replacing the ipad and it doesn't look like a hardware issue.
Thanks for your help.
Regards,
Yohanna
