| Event Id | 2003 |
| Source | MSExchangeIMC |
| Description | A new TCP/IP connection has been made to host x.x.x.x (for domain.com). Logfile: L0000000.LOG |
| Event Information | According to Microsoft: The domain that is displayed in each of these Success Audit events will remain the same until the Internet Mail Service is stopped and restarted. At that point the domain name for the first piece of mail that is forwarded to the specified host on the Connections tab will be used for each new Success Audit event 2003. This process will continue each time the Internet Mail Service is restarted. This will not cause problems with mail flow and can be ignored. The IP address portion of the event description should be correct for the host that is responsible for relaying the outbound SMTP mail. If SMTP Protocol Log is also turned on, the event listed above will display the name of the log file where this SMTP transaction was recorded. This can be found in the \exchsrvr\imcdata\log folder. If SMTP Protocol Log is set to None the value for Logfile in this event will display None. |
| Reference Links | XFOR: Event ID 2003 Displays the Wrong Destination Domain |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.