Our Directory Services event log on the DC fill up with Event log ID: 1172 and 1138, I believe itís related to exchange. Does everyone know where these logs come from and what triggered the logging?
Log Name: Directory Service Source: Microsoft-Windows-ActiveDirectory_DomainService Event ID: 1172 Task Category: MAPI Interface Level: Information Keywords: Classic User: DOMAIN\userID Computer: DC FQDN Internal event: A client process has connected to Active Directory Domain Services with the following RPC binding.
RPC binding: ncacn_ip_tcp: IP Address of the Client machine
Looks like you might have enabled debug logging, and never turned it off. Check regkey: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\4 MAPI Interface Events", and set it to 0.
Make it as simple as you can, but not simpler -- Albert Einstein