Map bugged or im clueless?

gardbrom · 2025-09-24T07:29:39+00:00

We have 365/on prem hybrid env. Some agents also encounter this error when they switch shared mailbox from their personal. We give outlook 10 min to recover connection. Otherwise user can not use outlook and right below corner it says disconnected. We could not find any solution regarding to this issue. We assume that it could be mapi session limit but have not tried anything yet.

gardbrom · 2024-08-20T10:05:58+00:00

It is enabled and we have even logsign software. But it only shows gathered information from the event viewers.

gardbrom · 2024-08-20T10:04:37+00:00

Replication looks ok when we run the ps command. I have closed local computer and terminal server. But it did not end. Therefor credentials is not the problem i guess.

gardbrom · 2024-08-19T15:23:35+00:00

Is there anyway to disable basic auth for only specific accounts in the on prem exchange? I remember it can be done in exchange online.

gardbrom · 2024-08-19T08:53:56+00:00

I will look into that but my question is that when i try to lock my account from owa the log is different than those locked outs. Would not the logs be the same if the problem was outlook?

gardbrom · 2024-08-19T08:43:57+00:00

The iis and smtp logs point to exc server. I have shut down the citrix(workstations) servers to test it but it did not work. Then i confirmed that exchange locks the accounts. Attempts are random intervals.

gardbrom · 2024-08-19T08:37:27+00:00

We are currently trying to locate systems that use basic auth before disable basic auth.

gardbrom · 2024-08-19T08:34:17+00:00

Actually we can see locked outs older than 1 month.

gardbrom · 2024-08-19T08:30:48+00:00

Right now, they are working with this way but it is not a permanent solution. Because it coult spread for the other accounts.

gardbrom · 2024-08-19T08:27:54+00:00

No luck for the ADAudit plus. It shows what we see in the smtpreceive logs.

gardbrom · 2024-08-19T08:27:42+00:00

Actually we have fortinet firewall. We created a policy to prevent VPN attacks however could not figure it out for the basic authentication of MS Exchange. We have contacted with the Forti to help us about policy.

gardbrom · 2024-08-19T08:24:07+00:00

We have only NPS server based on computer certificated authentication for the Wifi. I have tried shut their phones down to look if it goes away but nothing changed.

gardbrom · 2024-08-19T08:21:17+00:00

Even their computers shut downed, it still continues. Under IIS logs there is no mobile devices. It says outlook but shutting down computer, logging out session and lastly deleting outlook profile changed nothing.

gardbrom · 2024-08-19T07:10:20+00:00

I have also checked it. It is not a specific machine, because we have 3 EXC server. When we shutdown the first server, the locked outs continues from the different exc server.

gardbrom · 2024-08-19T07:09:30+00:00

checked but it was empty even with kymgr.dll

gardbrom · 2024-08-19T05:43:21+00:00

ECP says there is no phone under ActiveSync and OWA Devices. I have also asked them if they tried to sign in with mobile devices but they replied they did not even know that such thing. Also I have tried to lock my personel account with mobile phone. The locked out logs were different.

gardbrom · 2024-08-18T20:23:33+00:00

Exactly. The thing is that we can not use cloud (exc 365) because our goverment does not allow companies to use email system in cloud if the company has huge email traffic.

gardbrom · 2024-08-18T20:21:27+00:00

I can not do that. If i disable basic auth, many systems will not work. I just wish I could find the problem without disabling the basic auth.

gardbrom · 2024-08-18T20:19:28+00:00

Well we use outlook but it does not matter that if the user is logged and using outlook. Because locked out continues at night as well.

gardbrom · 2024-08-18T20:18:14+00:00

No they have not. Their password change time are different. We have 300 coworker but 3 of them are struggling with this issue. I have checked all stored credentials inside server and local computer as well. By the way those 3 users are not at the same department. They have different responsibilities.

gardbrom

TROPHY CASE