Shared mailboxes gets locked out

Neverest 1 Reputation point
2020-09-14T15:27:31.673+00:00

We have a mysterious problem where our shared mailboxes gets locked out. The origin is always Outlook on some of the users computers. I can see in the eventlog there are 4648 events recorded similar to these:

A logon was attempted using explicit credentials.

Subject:
    Security ID:        privdomain\xuserx
    Account Name:       xuserx
    Account Domain:     privdomain
    Logon ID:       0x76CBE
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
    Account Name:       sharedmailbox@privdomain.com
    Account Domain:     privdomain
    Logon GUID:     {00000000-0000-0000-0000-000000000000}

Target Server:
    Target Server Name: ex01.privdomain.com
    Additional Information: ex01.privdomain.com

Process Information:
    Process ID:     0x100c
    Process Name:       C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Network Information:
    Network Address:    10.20.30.40
    Port:           443

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.

What I have problems understanding is how Outlook lock out the mailbox user, when the users are logging on to the mailboxes with their own user credentials? They use the add account feature from within Outlook, where they add the email address of the shared mailbox and the shared mailbox is added as an aditional mailbox without any question about username or password. Both user and shared mailbox are on on-prem Exchange 2016, while Outlook is current 365 app. The users locking out the shared mailboxes are not getting locked out them selves.

They do add the mailbox similar to the following blog, but they are not prompted for a username and password: https://www.michev.info/Blog/Post/2025/how-to-add-a-shared-mailbox-as-additional-account-in-outlook-2016-build-8431-and-above-on-windows-10-1709-and-above

We also have a fair bit of users getting locked out, seemingly from the usermanager service on their computers, but we are unsure if it is related somehow.

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,669 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Andy David - MVP 149.1K Reputation points MVP
    2020-09-14T16:17:07.823+00:00

    Is the shared mailbox AD account enabled? If so, disable it. No one should logging on to it directly anyway.
    Also the regular users should not have to add the additional mailbox if they have full mailbox access to it. It will show automatically in their Outlook profiles on the left side.

    0 comments No comments

  2. Neverest 1 Reputation point
    2020-09-14T21:47:02.097+00:00

    The shared mailboxes AD user accounts are disabled. That's why I think it is mysterious. The credentials are never provided for the shared mailbox and the AD user is disabled, but its still getting locked out from the users that have it added as a second account.

    From the event posted above, the xuserx is the users ad account creating the event, while it is the shared mailbox account that was locked out.

    Edit: The users get rights on the mailbox by AD security group, that's why the backlinks are not created. They prefer to add the mailbox this way, as they do not have to change from address when answering mails and they can change rules without having to log in to webmail. I am not the Exchange admin in this company, but have some experience. I just got the problem with the locked accounts and figuring out why its happening from the clients.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.