Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Lots of failed login attempts from SWJobEngineWorker2x64.exe attempting to login with local Administrator account

As above, since the 18th March we have seen lots of failed logins (Event ID 4625) coming from the process SWJobEngineWorker2x64.exe and trying to authenticate using an account called 'Administrator'. Can anyone tell me what is going on here? I've looked through the config elements for our Orion installation and cannot see anywhere where this account has been assigned.

This might or might not be related I'm also getting lockout events logged in NPM, telling me the local 'Admin' account in Orion (internal account NOT active directory) has been locked out for 15 minutes. What is confusing about this message is that I have disabled that account from logging in......?!

What gives?! - Has anyone seen this behaviour before?

Find more posts tagged with

Comments

adam.beedell

Jobengine is the thing that does stuff
Administrator will be in one of the creds libraries.
Someone configured solarwinds to monitor using that account.

Maybe that even used to be fine and someone else changed the account or the permissions

Probably 1) find the account in the cred library
2) look to see if it's broke in one place or all
2a) If All, change the password on one end or the other
2b) If one, fix the permissions on that thing
2c) If not obvious, look for SQL monitors

adam.beedell

In addition, you probably want to set up some alerts looking for Unkowns/Greys, aint a healthy environment without that

Quick Links

Cisco ASR Devices
Cisco ASR Devices.pollerCisco ASR Devices
Basic SWQL Syntax
SWQL is built on the framework of SQL and as such supports most of the standard clauses as part of a query. A very simple example query is: SELECT Caption, IPAddress, Vendor, ResponseTime FROM Orion.Nodes Dissecting this query is relatively straightforward: show some fields (Caption, IP address, Vendor, and Response Time)…
Cisco ASA SSL Tunnels
Active SSL Tunnels-ASA.UnDPThis poller *should* display the number of Active SSL VPN (Anyconnect) Tunnels currently connected to your box. However, I tried it with my 5520 running 8.0.4 and for some reason I get a OID Not Supported. Here's my post in the forum: *EDIT* This is confirmed working with at least Interm release…
HP ProCurve Switches Hardening check
HP ProCurve Switches Hardening check.xmlGeneral hardening for HP switches