Hello,
I apologize if this has already been asked, (and I did trying to do a search for these keywords but returned nothing), but I am seeing UserLogonFailure events on my SLEM however their is no user name. The eventinfo is Logon Failure "\"
The insertion Ip is our exchange 2013 server. We do not have any blank users or accounts so I am guessing this is some masked service account or ?
Has anyone else see this?
