nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
- SolarWinds Academy
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
- Goal Oriented AI
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

User is always locked out in Active Directory, based on the investigation a polling engine is the source for the lockout

oluap

a user is always reporting that one of the polling engine was causing his Active Directory account to locked out. upon checking on the server there was no created profile under his account.HOw can i resolve the lock out

Find more posts tagged with

Comments

oluap

it works thank you for your help

oluap

Thank You Ronan

ronan.tonilon

Hi @oluap ,

The Active Directory account lockout is most likely caused by an outdated or misconfigured credential being used silently by a polling engine. Use SWQL, services/task checks, and credential management to trace and remove any use of that AD account. Enable AD auditing if needed for deep trace.

Cause Possibilities:

Credential used in Scheduled Tasks, Services, or Scripts on the polling engine
Old WMI/Windows credentials saved in:
- Application Monitor templates (SAM)
- Scheduled discoveries
- Device connection profiles (NCM)
Agent-based monitoring trying to authenticate using wrong credentials
Orion Platform Credential Store (shared credentials) referencing the user's AD account

What to do:

Check for Credential Usage in SolarWinds:
- Run this SWQL query to find where the user’s account is being used:
```
SELECT CredentialID, Name, CredentialOwner, CredentialType 
FROM Orion.Credential
WHERE Name LIKE '%username%' OR CredentialOwner LIKE '%username%'
```
  Replace %username% with the AD account with the problem.
- Then check where that CredentialID is being referenced:
  - In SAM Application Templates
  - In Discovery Profiles (Settings → Network Discovery → Manage Discoveries)
  - In NCM Connection Profiles
Check the Polling Engine's Windows Services & Scheduled Tasks.
- On the polling engine causing the lockout:
  - Run services.msc and check if any service (especially SolarWinds Collector, Agent, or custom scripts) is running under that user’s AD account.
  - Open Task Scheduler and check if any task is set to run under the user’s AD account.
- Look for:
  - Scripts
  - Custom pollers
  - Agent push jobs
Agent Configuration (if used)
- If SolarWinds Agent is deployed:
  - Check if the agent on the node is configured to use Windows credentials
  - Use the Agent Management page in the console to review credentials
Enable AD Account Lockout Auditing (Optional)
- If the above steps are inconclusive, enable account lockout auditing on your Domain Controllers:
  - Group Policy: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy → Logon/Logoff → Audit Account Lockout
- Then:
  - Use Event Viewer → Security Log on the DC.
  - Look for Event ID 4625 (logon failure) or 4740 (account locked).
  - This will help pinpoint the machine and process name causing the lockout.

Hope this helps.

Quick Links

Cisco Firepower Threat Defense FTD-1.3.6.1.4.1.9.1.2320.ConfigMgmt-Commands
Cisco Firepower Threat Defense FTD-1.3.6.1.4.1.9.1.2320.ConfigMgmt-CommandsExported with NCM 2023.4.2
Summary of Alerts Generated
AlertSummary.xmlHi All, I've done some work to tidy up our alert definitions (both the Alert Manager and Alert Actions) and the more important alerts have now been tailored and given a "[ *** ]" prefix so it is easy to see the alerts we have catered for versus those that might appear once in a while. I am monitoring this…
Dynamic Interface Dashboard; HTML/JS
I wanted to share a new dashboard a co-worker ( @mblackburn ) came up with to help us better view groups of interfaces and various metrics for each. Using a single HTML widget, we are able to visually compare numerous different interfaces by populating each interface dataset onto its own graph. We are able to view…
PALO-ALG - Logging
PALO-ALG - Logging.xmlPalo Alto Networks ALG Security Technical Implementation Guide :: Version 2, Release: 3 Benchmark Date: 27 Oct 2022