Event ID - 2003

Event Id2003
DescriptionA new TCP/IP connection has been made to host x.x.x.x (for domain.com). Logfile: L0000000.LOG
Event InformationAccording to Microsoft:
The domain that is displayed in each of these Success Audit events will remain the same until the Internet Mail Service is stopped and restarted. At that point the domain name for the first piece of mail that is forwarded to the specified host on the Connections tab will be used for each new Success Audit event 2003. This process will continue each time the Internet Mail Service is restarted. This will not cause problems with mail flow and can be ignored. The IP address portion of the event description should be correct for the host that is responsible for relaying the outbound SMTP mail.
If SMTP Protocol Log is also turned on, the event listed above will display the name of the log file where this SMTP transaction was recorded. This can be found in the \exchsrvr\imcdata\log folder. If SMTP Protocol Log is set to None the value for Logfile in this event will display None.
Reference LinksXFOR: Event ID 2003 Displays the Wrong Destination Domain

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.