How to Check and Block IP Addresses Causing Account Login Failures in Exchange 2013, 2016, and 2019 Application Logs

Exchange servers play a crucial role in facilitating email communication within organizations. However, it is important to monitor and secure these servers to prevent unauthorized access and potential security breaches. One way to enhance security is by regularly checking the application logs for account login failures and identifying the source IP addresses causing those failures. In this article, we will guide you through the process of checking the application logs and blocking the problematic IP addresses upstream with the help of your ISP.

Step 1: Accessing the Application Logs

To begin, you need to access the application logs on your Exchange server. Follow these steps:

1. Open the Exchange Admin Center (EAC) or Exchange Management Shell (EMS) depending on your preference.
2. Navigate to the server where you want to check the logs.
3. Locate the “Application Logs” section and click on it.
4. Look for any entries related to account login failures. These entries are usually marked with a specific event ID, such as Event ID 4625.

Step 2: Identifying the Problematic IP Addresses

Once you have accessed the application logs and found the relevant entries for account login failures, the next step is to identify the IP addresses causing these failures. Follow these steps:

1. Look for the “Failure Reason” or “Failure Code” field in the log entries. This field provides information about the reason behind the login failures.
2. Search for the “Source Network Address” or “Client IP Address” field in the log entries. This field contains the IP address from which the login attempts were made.
3. Note down the IP addresses causing the failures. You may find multiple IP addresses if there are multiple login failures.

Step 3: Blocking IP Addresses Upstream with Your ISP

Now that you have identified the problematic IP addresses, it is time to take action and block them upstream with the help of your Internet Service Provider (ISP). Follow these steps:

1. Contact your ISP’s customer support and inform them about the IP addresses causing account login failures.
2. Provide the ISP with the list of IP addresses and explain the situation.
3. Request the ISP to block these IP addresses at their network level, preventing any traffic from reaching your Exchange servers.
4. Follow any additional instructions provided by the ISP to complete the blocking process.

Blocking the IP addresses upstream with your ISP ensures that the problematic traffic never reaches your Exchange servers, thereby enhancing the overall security of your email infrastructure.

Additional Security Measures

While blocking the IP addresses upstream is an effective step, it is also important to implement additional security measures to protect your Exchange servers. Consider the following:

• Enable strong password policies and multi-factor authentication for user accounts.
• Regularly update and patch your Exchange servers to fix any known security vulnerabilities.
• Implement intrusion detection and prevention systems to monitor and block suspicious network activity.
• Train your users on best practices for email security, such as avoiding clicking on suspicious links or opening attachments from unknown sources.

By combining these measures with the blocking of IP addresses causing account login failures, you can significantly enhance the security of your Exchange servers and protect your organization’s sensitive email data.

In conclusion, regularly checking the application logs for account login failures in Exchange 2013, 2016, and 2019 servers is crucial for maintaining the security of your email infrastructure. By identifying and blocking the IP addresses causing these failures upstream with the help of your ISP, you can prevent unauthorized access and potential security breaches. Remember to implement additional security measures to further strengthen your Exchange server’s security.