1
MAPIEWS Administrative events not getting logged UNLESS I block a country
Problem reported by Brian A. - 5/22/2024 at 2:08 PM
Submitted
I'm getting failed login events from Germany (DE) only when Germany (DE) is blocked. If Germany (DE) is not blocked, I don't get any event recorded. This is happening when adding an account using eM Client on both IOS and Android.

If I allow Germany (DE) as an exception, no events get recorded from German IP address. If Germany is blocked, I get an event EVERY TIME I add an account on either IOS or Android and on IOS EVERY TIME I refresh after closing the app.

The IP when adding/refreshing and account on IOS is 157.90.238.237
The IP when adding an account on Android is 167.235.141.164

1) Why are the events not getting logged when Germany is allowed as an exception?
2) Why is eM Client authenticating from Germany with my credentials (probably a question for eM Client)?

[2024.05.22] 16:06:05.305 [157.90.238.237] MAPIEWS User test@mydomain.com with IP 157.90.238.237 attempting login from country Germany (DE) not on the allowed country list.
[2024.05.22] 16:06:05.305 [157.90.238.237] MAPIEWS NtlmAuthenticate test@mydomain.com is blocked by country auth block
[2024.05.22] 16:29:42.964 [xx.xx.xx.xx] MAPIEWS Login successful: With user test@mydomain.com
[2024.05.22] 16:06:42.803 [157.90.238.237] MAPIEWS User test@mydomain.com with IP 157.90.238.237 attempting login from country Germany (DE) not on the allowed country list.
[2024.05.22] 16:06:42.803 [157.90.238.237] MAPIEWS NtlmAuthenticate test@mydomain.com is blocked by country auth block
[2024.05.22] 16:29:42.964 [xx.xx.xx.xx] MAPIEWS Login successful: With user test@mydomain.com
[2024.05.22] 16:18:05.650 [157.90.238.237] MAPIEWS User test@mydomain.com with IP 157.90.238.237 attempting login from country Germany (DE) not on the allowed country list.
[2024.05.22] 16:18:05.650 [157.90.238.237] MAPIEWS NtlmAuthenticate test@mydomain.com is blocked by country auth block
[2024.05.22] 16:29:42.964 [xx.xx.xx.xx] MAPIEWS Login successful: With user test@mydomain.com
[2024.05.22] 16:21:41.678 [167.235.141.164] MAPIEWS User test@mydomain.com with IP 167.235.141.164 attempting login from country Germany (DE) not on the allowed country list.
[2024.05.22] 16:21:41.678 [167.235.141.164] MAPIEWS NtlmAuthenticate test@mydomain.com is blocked by country auth block
[2024.05.22] 16:28:25.455 [xx.xx.xx.xx] MAPIEWS Login successful: With user test@mydomain.com
[2024.05.22] 16:28:59.316 [157.90.238.237] MAPIEWS User test@mydomain.com with IP 157.90.238.237 attempting login from country Germany (DE) not on the allowed country list.
[2024.05.22] 16:28:59.316 [157.90.238.237] MAPIEWS NtlmAuthenticate test@mydomain.com is blocked by country auth block
[2024.05.22] 16:29:42.964 [xx.xx.xx.xx] MAPIEWS Login successful: With user test@mydomain.com
[2024.05.22] 16:37:14.817 [157.90.238.237] MAPIEWS User test@mydomain.com with IP 157.90.238.237 attempting login from country Germany (DE) not on the allowed country list.
[2024.05.22] 16:37:14.817 [157.90.238.237] MAPIEWS NtlmAuthenticate test@mydomain.com is blocked by country auth block
[2024.05.22] 16:29:42.964 [xx.xx.xx.xx] MAPIEWS Login successful: With user test@mydomain.com

2 Replies

Reply to Thread
0
Kyle Kerst Replied
Employee Post
When you set up your account in eM Client - are you using the automatic account setup process or setting up the account manually? If you use the automatic account setup process it may use some servers on their end to facilitate the autodiscover process. 
Kyle Kerst IT Coordinator SmarterTools Inc. www.smartertools.com
0
Brian A. Replied
But why do I not get a "hit" when Germany is open... Why do I only get a log entry when Germany is closed? I understand it has something to do with their autodiscoer.

Reply to Thread