when running the hafnium powershell script on our exchange 2013 server, the only thing returned was two entries in autodiscover.
each ended with: the email address cannot be found.
2021-03-03T11:32:23.754Z,ab20f7df-07ff-4abf-bc47-ce9e31fea8bd,15,0,1395,0,,Negotiate,true,NT AUTHORITY\SYSTEM,,ExchangeServicesClient/0.0.0.0,86.105.18.116,JFIEX2013P,MYEXCHANGE.MYDOMAIN.COM,POX,200,500,0,0,1,,,,,GlobalThrottlingPolicy_f9fb2403-54c7-412d-b51b-7f13cdaa45cb,,,1,3,0,3,2,,10,ADSessionSettingsFromAddress=0;ADRecipientSessionFindBySid=0;Caller=null;ResolveMethod=Unknown;RequestedRecipient=null;RequestedUser=administrator@Mydomain.com;S:ServiceCommonMetadata.RequestSize=347;S:WLM.Bal=300000;S:WLM.BT=Ews;S:BudgetMetadata.MaxConn=27;S:BudgetMetadata.MaxBurst=300000;S:BudgetMetadata.BeginBalance=300000;S:BudgetMetadata.Cutoff=3000000;S:BudgetMetadata.RechargeRate=900000;S:BudgetMetadata.IsServiceAct=False;S:BudgetMetadata.LiveTime=00:00:00;S:BudgetMetadata.EndBalance=300000;Dbl:WLM.TS=10;I32:ADS.C[ad-2]=2;F:ADS.AL[ad-2]=2.5936;I32:ATE.C[dc1.mydomain.com]=1;F:ATE.AL[dc1.mydomain.com]=0;I32:ADS.C[dc1]=1;F:ADS.AL[dc1]=2.3683,,message=The email address can't be found.;
is this false positve, indication of scan or what? all other tests showed no issue.