XADM: Event ID: 1016 Logged Incorrectly in Application Event Log

ID: Q147362

The information in this article applies to:

SYMPTOMS

By default, the Microsoft Exchange Service Account can log in to any mailbox. However, when a Service Account is used to log in to a mailbox, this event should be logged in the Windows NT Application Event Log as Event ID 1016 with the following text:

NT User ExchService logged on to ExUser1 mailbox, and is not the Primary Windows NT Account on this mailbox.
where ExchService is the Service Account and ExUser1 is the mailbox that the Service Account logs in to.

This information is logged whether or not you have logging turned on for the Microsoft Exchange Private Information Store (IS). This information is not always logged properly as in the following example:
  1. Turn off logging on the Private IS.


  2. Log in as the Service Account (ExchService) and open the ExUser1 mailbox.

    You initially get the following event logged in the Windows NT Event Viewer:
    EVENT ID: 1016
    NT User ExchService logged on to ExUser1 mailbox, and is not the Primary Windows NT Account on this mailbox.


  3. In the Microsoft Exchange client, open the Tools menu, click Services, click Exchange Server, click Properties, click Advanced Page, and add ExUser2 mailbox to the list to open.

    The Windows NT Event log will have the same entry:
    EVENT ID: 1016
    NT User ExchService logged on to ExUser1 mailbox, and is not the Primary Windows NT Account on this mailbox.
    The log message should say:
    NT User ExchService logged on to ExUser2 mailbox, and is not the Primary Windows NT Account on this mailbox.



CAUSE

This is logged properly if logging is set to at least Minimum on the Private IS, but will not be logged properly if logging is set to None.


MORE INFORMATION

For more information about preventing administrators from viewing user mail, please see the following article in the Microsoft Knowledge Base:

Q147354 XADM: Service Account Can Log In to any Mailbox


STATUS

Microsoft has confirmed this to be a problem in Microsoft Exchange version 4.0. This problem has been corrected in the latest Service Pack for Microsoft Exchange Server. For information on obtaining the Service Pack, query on the following word in the Microsoft Knowledge Base (without the spaces):

S E R V P A C K

Additional query words: 


Keywords          : kbusage kbbug4.00 kbfix4.00.sp3 XADM 
Version           : winnt:4.0
Platform          : winnt 
Issue type        :

Last Reviewed: March 18, 1999