Event 4223

[Ed_Jackson]

I started seeing this warning in the event viewer every 10 minutes today:

Authentication is currently being delayed due to a suspected brute-force attack.

Number of failures: 55

Delay period remaining: 9:12 (mins:secs)

During this period users will experience short delays when searching or accessing archived items.

EV seems to be working OK, but opening archived email is slow, as the error said it will be. Can anyone shed some light on the cause of thi warning?

EV 8, SP1
Win 2003 SP2 virtual 64 bit server.
Thank you.
Ed

[Joseph_Rodgers]

Ed,

I did a quick Google (as I am sure you did) and your message is the #2 hit for "event 4223" pretty impressive!

I would recommend  using dtrace to try and determine the source.

Did you recently change any of the service account passwords or add a new OWA server?

Try tracing the authserver

Regards
Joe