In my Exchange server event viewer, I consistently see a flood of event 1016 IDs. Essentially saying that “NT user\%exchangeservicename% logged onto “user” mailbox, and is not the primary Windows NT account on this mailbox.” I read in a hacker awareness book that this could be bad. I don’t think so, it seems like some kind of normal wierd exchange message. Anyone have any clue what to do about this?
