Getting two different sub-status codes on same username in Exchange Server

YahyaBatla 0 Reputation points
2023-01-17T11:18:44.7966667+00:00

Hello!
During monitoring of Exchange Server logs I found that multiple login failure attempts were made by existing valid users on exchange server having event ID 4625 with two different sub-status codes:

 

  1. 0xC0000064 ( Username does not exist )
  2. 0xC000006A ( user name is correct but the password is wrong )

 

I know the user does exist, there's no typing mistake in the username but it still shows sub-status code 0xC0000064 and in some events it shows 0xC000006A ( which could be normal because of user typing  wrong password ).
Did anyone face any similar situation? Does anybody know what could be the possible reason?
TIA

Exchange Server
Exchange Server
A family of Microsoft client/server messaging and collaboration software.
1,170 questions
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,343 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions