XADM: Event ID: 1016 Generated by a Virus Scan Software Account

• Microsoft Exchange Server, versions 4.0, 5.0, 5.5

SUMMARY

With an antivirus software package installed on your Exchange Server computer, you may receive many instances of the following event in the application event log:

Event ID 1016
NT User ExchService logged on to ExUser1 mailbox, and is not the Primary Windows NT Account on this mailbox.

MORE INFORMATION

Some antivirus software requires you to create an account with Service Account Admin permissions so the software can open all mailboxes and scan them. The account created for the antivirus software with Service Account Admin permissions is opening and scanning the mailboxes, and a 1016 event is logged for each mailbox.

This behavior is by design. For additional information on the 1016 event, click the article number below to view the article in the Microsoft Knowledge Base:

Q173692 XADM: Event 1016 Generated When You Open Mailbox or Schedule of Another User

Additional query words: av

Keywords : exc4 exc5 exc55
Version : winnt:4.0,5.0,5.5
Platform : winnt
Issue type : kbinfo