This morning I checked the Security Log in Event Viewer on my five CAS/HUB servers that are part of the same CAS Array. Three of the servers are showing user authentication logins just fine, found a few accounts that were getting Audit Failures at a very high rate that we are currently digging into. But what is more alarming is that only three of the five servers are showing any activity in the Security Log... I'm digging to see if there is a logging level difference somewhere.. but to my knowledge Exchange Logging for the most part are global settings..
Anyway, anyone have any thoughts?
Jason Meyer
