I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of faulure audits wich is an obvious dictionary attack with it cycling through users in alphabetical order. The workstation name was the same server that hosts the domain controller. Also the logon porcess was advapi. This stopped
In addition to this I have a large volume of MSExcahnge AL informations statements in the exchange application logs. 20-30 a second. Ldap operations, search of directory, and completed call to policy group provider.
What could be causing this and how to prevent it. We have consistent antivirus protections across the network and have run quick anti-malware on this server.
If there is anything I need to clarify please let me know. I am relatively new to active directory and exchange.