我们使用一台hub / cas服务器和一台边缘服务器运行Exchange 2010，并注意到安全事件日志中发生了一件奇怪的事情。 每隔30秒在边缘服务器上，我将得到一个来自中心服务器的login错误：
Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 9/24/2015 2:52:30 PM Event ID: 4625 Task Category: Logon Level: Information Keywords: Audit Failure User: N/A Computer: MailEdge01.example.com Description: An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: Account Domain: Failure Information: Failure Reason: The NetLogon component is not active. Status: 0xc0000192 Sub Status: 0x80090325 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: - Source Network Address: 192.168.1.56 Source Port: 25919 Detailed Authentication Information: Logon Process: Schannel Authentication Package: Microsoft Unified Security Protocol Provider Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network). The Process Information fields indicate which account and process on the system requested the logon. The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4625</EventID> <Version>0</Version> <Level>0</Level> <Task>12544</Task> <Opcode>0</Opcode> <Keywords>0x8010000000000000</Keywords> <TimeCreated SystemTime="2015-09-24T19:52:30.469590700Z" /> <EventRecordID>113299</EventRecordID> <Correlation /> <Execution ProcessID="580" ThreadID="816" /> <Channel>Security</Channel> <Computer>MailEdge01.example.com</Computer> <Security /> </System> <EventData> <Data Name="SubjectUserSid">S-1-0-0</Data> <Data Name="SubjectUserName">-</Data> <Data Name="SubjectDomainName">-</Data> <Data Name="SubjectLogonId">0x0</Data> <Data Name="TargetUserSid">S-1-0-0</Data> <Data Name="TargetUserName"> </Data> <Data Name="TargetDomainName"> </Data> <Data Name="Status">0xc0000192</Data> <Data Name="FailureReason">%%2306</Data> <Data Name="SubStatus">0x80090325</Data> <Data Name="LogonType">3</Data> <Data Name="LogonProcessName">Schannel</Data> <Data Name="AuthenticationPackageName">Microsoft Unified Security Protocol Provider</Data> <Data Name="WorkstationName">-</Data> <Data Name="TransmittedServices">-</Data> <Data Name="LmPackageName">-</Data> <Data Name="KeyLength">0</Data> <Data Name="ProcessId">0x0</Data> <Data Name="ProcessName">-</Data> <Data Name="IpAddress">192.168.1.56</Data> <Data Name="IpPort">25919</Data> </EventData> </Event> IP地址192.168.1.56是我们的主要networking中的hub / cas服务器的地址。 边缘服务器（不是域join服务器）位于我们的DMZ中。
这似乎不会导致任何问题，并且我看不到任何主机上出现任何消息（安全日志除外）。 我查看了防火墙，并且该消息似乎与端口50636上的RPC调用一致。我已经尝试重新创build边缘服务器和边缘订阅的证书。
这是需要修复的东西，还是有人知道为什么会发生？