user auditing on front-end exchange and dc's?

Discussion in 'Windows Server Systems' started by fimchick, Mar 21, 2006.

  1. fimchick

    fimchick OSNN Senior Addict

    hmm, i have a curious question that I'm confused about -- we have one front-end and two back-end exchange servers (everything is 2003). i was looking at the logs and trying to figure out which server will have a log of failed and successful login attempts for POP/SMTP authentication. would that be the front-end exchange server? the domain controller? both? why am I seeing a few successful logons in the front-end server's security log? are those OWA requests?

    can anyone clarify how user authentication occurs for POP/SMTP and which server I should look at for logon problem tracking?