hmm, i have a curious question that I'm confused about -- we have one front-end and two back-end exchange servers (everything is 2003). i was looking at the logs and trying to figure out which server will have a log of failed and successful login attempts for POP/SMTP authentication. would that be the front-end exchange server? the domain controller? both? why am I seeing a few successful logons in the front-end server's security log? are those OWA requests? can anyone clarify how user authentication occurs for POP/SMTP and which server I should look at for logon problem tracking? THANK YOU!!