Hello,
I apologize if this has already been asked, (and I did trying to do a search for these keywords but returned nothing), but I am seeing UserLogonFailure events on my SLEM however their is no user name. The eventinfo is Logon Failure "\"
The insertion Ip is our exchange 2013 server. We do not have any blank users or accounts so I am guessing this is some masked service account or ?
Has anyone else see this?
Sorry I neglected to include this info:
We have SLEM 6.0.1
Exchange runs on server 2012.. (not r2 yet)
Exchange is 2013.