I have an account that is no longer located in ADUC or exchange and we are still receiving bad username requests (by a 3rd party auditing application) where the account is hitting our primary DC. A couple of weeks back the user admitted to using his work e-mail info to open a gmail account. I deleted that instance and yet I am still seeing the audit requests. Anyone have any ideas?
Answer
I actually just discovered that I figured this out on my own. I found out that the user used his work credentials (setup in exchange) to create a gmail account. This caused all of the bad user name instances within exchange. I deleted that account about 3-4 weeks ago and I am finally no longer seeing it hit our exchange server. Phew!
Attribution
Source : Link , Question Author : Community , Answer Author : Community
