Event logs

Hello,

Is there ever any reason to find a user logged as logged on/off (event 540 &
538) on a mail server with no resources that users access directly? They log
on via the email server (non exchange) which authenticates with the AD.

Is this a possible hack attempt? The user is an internal corporate user.

It could be that the mail server application writes logon/logoff events (for
events like POP3 and SMTPAUTH logins) to the event log. You might want to
refer to the mail server's documentation to see if this is the case.

"Alex" <(E-Mail Removed)> wrote in message
news:0CF6C61E-2916-4DB5-B11E-(E-Mail Removed)...
> Hello,
>
> Is there ever any reason to find a user logged as logged on/off (event 540
> &
> 538) on a mail server with no resources that users access directly? They
> log
> on via the email server (non exchange) which authenticates with the AD.
>
> Is this a possible hack attempt? The user is an internal corporate user.